DEX aggregator Matcha Meta was a victim of a crypto scam with an estimated loss of around $16.8 million in digital assets. The attacker has allegedly swapped the tokens.
The broader cryptocurrency market has experienced another scam, resulting in a loss of $16.8 million.
These funds were withdrawn from Matcha Meta, a decentralized exchange aggregator. Several blockchain security firms, including PerkShield, have flagged the incident.
Matcha Meta Yet to Confirm Crypto Losses
Matcha Meta reported the security incident on Jan. 25, citing that it impacted its SwapNet integration.
Although the aggregator has not made any official statements attesting that users’ funds were lost, some analysts say it was a multi-million dollar drain of user funds.
However, the protocol immediately temporarily disabled SwapNet contracts.
We are aware of an incident with SwapNet that users may have been exposed to on Matcha Meta for those who turned off One-Time Approvals
We are in contact with the SwapNet team and they have temporarily disabled their contracts
The team is actively investigating and will provide…
— Matcha Meta 🎆 (@matchametaxyz) January 25, 2026
In addition, direct aggregator allowances were removed on Matcha Meta. According to PerkShield, the attacker has swapped about $10.5 million in USDC out of the estimated $16.8 million in assets that were stolen.
The attacker swapped Base for roughly 3,655 Ethereum ETH $2 889 24h volatility: 1.5% Market cap: $348.67 B Vol. 24h: $32.55 B , after which he began bridging the funds to Ethereum.
Blockchain security firm CertiK had initially reported a smaller estimated loss of around $13.3 million in USDC on Base.
In this case, the attack was identified as an “arbitrary call” vulnerability in the SwapNet contract, which gave the attacker the leverage to transfer funds approved to it.
“Users who have disabled One-Time Approval and have set direct allowances on individual aggregator contracts assume the risks of each aggregator,” Matcha Meta wrote in its X post.
South Korea Authorities Fall Victim to Crypto Scam
In related crypto scam news, South Korean prosecutors recently recorded a significant loss in their seized Bitcoin.
The funds were targeted in a phishing attack, resulting in an estimated loss of about 70 billion won, or roughly $48 million.
The loss was discovered by the Gwangju District Prosecutors’ Office during a routine inspection of confiscated crypto assets.
With cybercriminal activity on the rise, crypto firms are collaborating with law enforcement and industry partners to combat scams.
On Jan. 9, stablecoin issuer Tether announced a joint initiative launched with the United Nations Office on Drugs and Crime (UNODC).
This is a measure to counter organized crime, corruption, terrorism, and illicit financial flows through analytic and technical cooperation.
next