Incident All ledgers
Matcha: $13.4m
Matcha lost $13.4m on 25 January 2026. Ranked 166th of 1,272 crypto failures, with method, returned funds and comparable incidents.
- Date
- 25 January 2026
- Lost
- $13.4m
- Returned or repaid
- None recorded
- Target
- DeFi Protocol
- Category
- Frontend & Infrastructure
- Method
- Frontend Compromise
- Chains
- Base, Ethereum
On January 25, 2026, Matcha Meta users lost about $13.43M after an arbitrary-call flaw in the SwapNet aggregator let an attacker access tokens users had approved on Base and Ethereum. The frontend reportedly gave inadequate warnings about approval risks.
Against the ledger
- It ranks 166th of the 1,272 incidents with a known loss, and 22nd in 2026.
- It accounts for 12.9% of the $104.1m in known losses in January 2026.
- 93 incidents in the ledger are classified as Frontend & Infrastructure, for $7.49bn in total. This one is 0.2% of that.
- The ledger records no returned funds.
Closest in size by the same method
| Date | Target | Lost | Type | Method | Returned |
|---|---|---|---|---|---|
| 11 Jun 2023 | Floating Point Group | $15.0m | CEX | Key Leaked via Infrastructure | — |
| 07 Sept 2023 | Fortress Trust | $12.0m | CEX | Key Leaked via Infrastructure | — |
| 08 May 2025 | BitoPro | $11.5m | CEX | Key Leaked via Infrastructure | — |
| 30 Oct 2025 | Garden | $11.4m | DeFi Protocol | Key Leaked via Infrastructure | — |
| 28 Jan 2025 | DogWifTools | $10.0m | Other | Key Stored Publicly | — |
All failures in 2026 · The failures ledger
Amounts are DefiLlama’s estimates and can change as incidents are revalued. Its returned figure can include money a company repaid itself, not only funds recovered from attackers. Source: DefiLlama.
Cite this Bitminer.io, “Matcha, failures ledger”, data to 2 November 2026, https://bitminer.io/ledger/incident/matcha-2026-01-25/. How this is built