Breaches and incidentsBriefChecked against a primary source
SwapNet and Aperture Finance: closed-source contracts with arbitrary calls drained user approvals
Detected 25 Jan 2026 on Ethereum, Arbitrum, Base and BSC: SwapNet about USD 13.41M, Aperture about USD 3.67M (two separate incidents, over USD 17M combined).
- Disclosed
What happened
- Detected 25 Jan 2026 on Ethereum, Arbitrum, Base and BSC: SwapNet about USD 13.41M, Aperture about USD 3.67M (two separate incidents, over USD 17M combined). SwapNet losses hit Matcha Meta users who had turned off its one-time approval default.
- Root cause per BlockSec: insufficient input validation on low-level calls. Call target and calldata were attacker-controlled, so the contracts called transferFrom on tokens users had approved to them. Both sets of contracts were closed-source.
- Attribution: none.
- Response: Matcha Meta told users to revoke approvals to SwapNet. Aperture disabled affected app functions.
Sources
- https://blocksec.com/blog/17m-closed-source-smart-contract-exploit-arbitrary-call-swapnet-aperture
- https://meta.matcha.xyz/SwapNet-Incident-Post-Mortem
- https://www.theblock.co/post/386986/matcha-meta-swapnet-incident
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.