Verify a decision

{"actor":"system:backfill","investigation_id":"1b600779-6561-4201-8014-61c0c7125aa1","kind":"publish","page_slug":"matcha","published_at":"2026-05-20T03:30:51.356Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Matcha","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.businesswire.com/news/home/20220426006160/en/0x-Labs-Raises-%2470M-Led-By-Greylock-to-Continue-Expanding-Web3s-Core-Exchange-Infrastructure"},{"credibility":3,"name":"","type":"other","url":"https://matcha.xyz/about-matcha-dex-aggregator"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2023/05/24/0x-labs-releases-latest-version-of-dex-aggregator-matcha"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.matcha.xyz/article/permit2"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/349429/0x-dex-aggregator-matcha-solana-cross-chain-avoid-memecoin-rug-pulls"},{"credibility":3,"name":"","type":"other","url":"https://0x.org/case-studies/matcha-v2"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/386986/matcha-meta-swapnet-incident"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/matcha-meta-swapnet-defi-exploit-loss/"},{"credibility":3,"name":"","type":"other","url":"https://www.dlnews.com/articles/defi/matcha-meta-users-lose-millions-after-security-breach-at-integrated-protocol/"},{"credibility":3,"name":"","type":"other","url":"https://samczsun.com/the-0x-vulnerability-explained/"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/0x-dex-protocol-suspended-because-of-vulnerability-funds-safe"},{"credibility":3,"name":"","type":"other","url":"https://0x.org/post/0x-v2-bug-bounty-program"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.businesswire.com/news/home/20220426006160/en/0x-Labs-Raises-%2470M-Led-By-Greylock-to-Continue-Expanding-Web3s-Core-Exchange-Infrastructure"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/organization/0x-project"},{"credibility":3,"name":"","type":"other","url":"https://0x.org/legal/terms-of-service"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://0x.org/docs/developer-resources/bounties"},{"credibility":3,"name":"","type":"other","url":"https://cryptopolitan.com/matcha-meta-security-breach-16-8m-drained/"},{"credibility":3,"name":"","type":"other","url":"https://www.livebitcoinnews.com/matcha-meta-removes-direct-allowances-after-16-8m-swapnet-exploit-as-crypto-hacks-rise/"}]}],"sources_used":[],"summary":"Matcha (matcha.xyz) is a DEX aggregator built and operated by 0x Labs, launched in 2020, that routes trades across 130+ liquidity sources on 15+ blockchains using the 0x Protocol. The core Matcha platform has no history of direct exploits; however, Matcha Meta — a related but distinct meta-aggregator product launched later by the same team — suffered a $13.4M exploit in January 2026 via a third-party SwapNet contract, affecting users who had disabled the platform's default one-time approval security setting. 0x Labs is a well-funded, established entity whose protocol contracts have been audited by Trail of Bits, OpenZeppelin, and Ouroboros, and whose bug bounty program offers up to $1M via Immunefi.","timeline":[{"date":"2016-01-01","event":"0x Labs founded by Will Warren and Amir Bandeali in San Francisco.","source":""},{"date":"2018-01-01","event":"0x Protocol v1 launches on Ethereum mainnet, enabling peer-to-peer token exchange via off-chain order books and on-chain settlement.","source":""},{"date":"2019-07-12","event":"Critical vulnerability disclosed in 0x v2.0 Exchange contract by researcher samczsun, allowing signature bypass. 0x team shuts down contracts within hours; no funds lost.","source":""},{"date":"2020-04-01","event":"Matcha launches in closed beta as a DEX aggregator frontend built on 0x Protocol.","source":""},{"date":"2020-06-01","event":"Matcha opens to the public with gas-free trades and smart order routing across 15 DEXs.","source":""},{"date":"2022-04-26","event":"0x Labs raises $70M Series B led by Greylock, with participation from Pantera Capital, Jump Crypto, Coinbase, and others.","source":""},{"date":"2023-05-24","event":"Matcha v2 launches with multi-chain support including Ethereum, BNB Chain, and Polygon.","source":""},{"date":"2023-12-01","event":"Cross-chain swap functionality launches on Matcha.","source":""},{"date":"2024-07-01","event":"0x Labs launches bug bounty program via Immunefi for 0x v2, offering up to $1M for critical vulnerabilities.","source":""},{"date":"2025-01-01","event":"Matcha expands to Solana, becoming one of the first DEX aggregators to support both SVM and EVM chains in a single app.","source":""},{"date":"2026-01-26","event":"Matcha Meta (meta.matcha.xyz) suffers $13.4M exploit via a vulnerability in integrated third-party SwapNet router contract. 18 users affected; those who had disabled the default one-time approval setting were exposed. 0x Labs' own contracts were not compromised.","source":""},{"date":"2026-01-27","event":"Matcha Meta removes SwapNet as an available aggregator, disables the toggle allowing users to turn off one-time approvals, and publishes post-mortem.","source":""}]},"v":1}