BlockSec links $17M SwapNet and Aperture Finance losses to arbitrary-call flaw

On January 28 2026, security firm BlockSec published a technical review of attacks on SwapNet and Aperture Finance that together resulted in more than $17 million in losses. SwapNet, a DEX aggregator, lost over $13.4 million across Ethereum, Arbitrum, Base, and Binance Smart Chain due to an unvalidated function that enabled malicious low-level calls, while Aperture Finance saw about $3.67 million drained through a comparable arbitrary-call weakness in its liquidity management contracts. Both protocols have paused affected functionalities and urged users to revoke token approvals as they work with security specialists and law enforcement on recovery efforts.