Matcha Meta users lost $13.43M on January 25, 2026 when the SwapNet aggregator was exploited for arbitrary-call ability. The vulnerability allowed unauthorized access to user-approved tokens across Base and Ethereum. The frontend UI inadequately warned about approval risks.