Summary
Matcha (matcha.xyz) is a DEX aggregator built and operated by 0x Labs, launched in 2020, that routes trades across 130+ liquidity sources on 15+ blockchains using the 0x Protocol. The core Matcha platform has no history of direct exploits; however, Matcha Meta — a related but distinct meta-aggregator product launched later by the same team — suffered a $13.4M exploit in January 2026 via a third-party SwapNet contract, affecting users who had disabled the platform's default one-time approval security setting. 0x Labs is a well-funded, established entity whose protocol contracts have been audited by Trail of Bits, OpenZeppelin, and Ouroboros, and whose bug bounty program offers up to $1M via Immunefi.
Connected Entities
1 entities- + 2 more
Timeline(12 events)
2016-01-01
0x Labs founded by Will Warren and Amir Bandeali in San Francisco.
2018-01-01
0x Protocol v1 launches on Ethereum mainnet, enabling peer-to-peer token exchange via off-chain order books and on-chain settlement.
2019-07-12
Critical vulnerability disclosed in 0x v2.0 Exchange contract by researcher samczsun, allowing signature bypass. 0x team shuts down contracts within hours; no funds lost.
2020-04-01
Matcha launches in closed beta as a DEX aggregator frontend built on 0x Protocol.
2020-06-01
Matcha opens to the public with gas-free trades and smart order routing across 15 DEXs.
2022-04-26
0x Labs raises $70M Series B led by Greylock, with participation from Pantera Capital, Jump Crypto, Coinbase, and others.
2023-05-24
Matcha v2 launches with multi-chain support including Ethereum, BNB Chain, and Polygon.
2023-12-01
Cross-chain swap functionality launches on Matcha.
2024-07-01
0x Labs launches bug bounty program via Immunefi for 0x v2, offering up to $1M for critical vulnerabilities.
2025-01-01
Matcha expands to Solana, becoming one of the first DEX aggregators to support both SVM and EVM chains in a single app.
2026-01-26
Matcha Meta (meta.matcha.xyz) suffers $13.4M exploit via a vulnerability in integrated third-party SwapNet router contract. 18 users affected; those who had disabled the default one-time approval setting were exposed. 0x Labs' own contracts were not compromised.
2026-01-27
Matcha Meta removes SwapNet as an available aggregator, disables the toggle allowing users to turn off one-time approvals, and publishes post-mortem.
Decision Log
- hash: FS3Ep3zjgni42Wwq5XQs8nCHqLjRNWp4TCRebuxnRA5N
- hash: 86RBqtTY2Fqz2ScmZ2oRp6D2gSooQTXVYksxtLSDRqBT
- hash: 54Biv4eUjQQbMXBDTkPrxPLEeoMuicuFga2zMfoaThaP
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:18 AM
last updated: 6/4/2026, 12:14:53 AM
avoid.net — verified advice for a post-truth world