Digital Asset
Intelligence
Security Incident · ETH Ecosystem

SwapNet Smart Contract Vulnerability: $13.43M Reported Loss

·Historical incident record

Incident Overview

SwapNet’s closed-source aggregator contracts were exploited via an arbitrary-call vulnerability due to insufficient input validation on user-controlled parameters. This allowed attackers to abuse existing token approvals (especially from users who disabled Matcha Meta’s One-Time Approval) to execute unauthorized transferFrom calls, draining ~$13.43M across Base, Ethereum, Arbitrum, and BSC. The attacker swapped large amounts of USDC to ETH on Base and bridged funds. Matcha Meta and 0x core contracts were unaffected.

Sources & References

Original incident referencehttps://x.com/PeckShieldAlert/status/2015608261119217671 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 3,670,000
  2. Incident date
    Target

    SagaEVM

    Attack methodSmart Contract Vulnerability
    Reported loss$ 7,000,000
  3. Incident date
    Target

    MakinaFi

    Attack methodSmart Contract Vulnerability
    Reported loss$ 4,130,000
  4. Incident date
    Target

    Scroll

    Attack methodThe X account was hacked
    Reported lossNot disclosed
  5. Incident date
    Target

    Paradex

    Attack methodSupply Chain Attack
    Reported loss0