A recent hack of SwapNet led to a loss of $16.8 million, prompting criticism of Circle for not acting on freezeable funds.
On January 26, an attack on the liquidity provider SwapNet resulted in a significant loss of $16.8 million. The incident was initially highlighted by Matcha Meta, a decentralized exchange aggregator, which alerted users that those who had disabled the one-time approval feature were at risk.
In response to the breach, Matcha Meta's developers removed this feature to enhance user security. PeckShield reported that the attacker exchanged $10.5 million in USDC for approximately 3,655 ETH on the Base network and began withdrawing the funds.
CertiK analysts confirmed a theft of $13.3 million in USDC during this incident. Despite the substantial loss, the SwapNet team has not yet issued a public statement regarding the hack.
Criticism has arisen regarding Circle, the issuer of USDC, as ZachXBT pointed out that $3 million in coins remained in a potentially freezeable address, yet Circle took no action even ten hours post-attack. He expressed his frustration, questioning why developers should continue to rely on USDC given Circle's lack of responsiveness to protect users.
"Why should anyone continue building on USDC when you, as a centralized issuer, never protect your users' interests?" — ZachXBT.
The DeFi sector has faced a tumultuous start in 2026, with several other hacks reported, including a $26.4 million loss from the Ethereum verification protocol Truebit and $7 million from the Saga blockchain. The previous year saw a record $3.4 billion in thefts from decentralized projects, with three major incidents accounting for a significant portion of the losses. Web3 security expert Mitchell Amador has remarked that such hacks could spell disaster for many protocols in the space.
