Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·ohWY5m…C9q2Summary
Matcha (matcha.xyz) is a DEX aggregator built and operated by 0x Labs, launched in 2020, that routes trades across 130+ liquidity sources on 15+ blockchains using the 0x Protocol. The core Matcha platform has no history of direct exploits; however, Matcha Meta — a related but distinct meta-aggregator product launched later by the same team — suffered a $13.4M exploit in January 2026 via a third-party SwapNet contract, affecting users who had disabled the platform's default one-time approval security setting. 0x Labs is a well-funded, established entity whose protocol contracts have been audited by Trail of Bits, OpenZeppelin, and Ouroboros, and whose bug bounty program offers up to $1M via Immunefi.
Connected Entities
1 entities- + 2 more
Timeline(12 events)
2016
0x Labs founded by Will Warren and Amir Bandeali in San Francisco.
2018
0x Protocol v1 launches on Ethereum mainnet, enabling peer-to-peer token exchange via off-chain order books and on-chain settlement.
12 July 2019
Critical vulnerability disclosed in 0x v2.0 Exchange contract by researcher samczsun, allowing signature bypass. 0x team shuts down contracts within hours; no funds lost.
April 2020
Matcha launches in closed beta as a DEX aggregator frontend built on 0x Protocol.
June 2020
Matcha opens to the public with gas-free trades and smart order routing across 15 DEXs.
26 April 2022
0x Labs raises $70M Series B led by Greylock, with participation from Pantera Capital, Jump Crypto, Coinbase, and others.
24 May 2023
Matcha v2 launches with multi-chain support including Ethereum, BNB Chain, and Polygon.
December 2023
Cross-chain swap functionality launches on Matcha.
July 2024
0x Labs launches bug bounty program via Immunefi for 0x v2, offering up to $1M for critical vulnerabilities.
2025
Matcha expands to Solana, becoming one of the first DEX aggregators to support both SVM and EVM chains in a single app.
26 January 2026
Matcha Meta (meta.matcha.xyz) suffers $13.4M exploit via a vulnerability in integrated third-party SwapNet router contract. 18 users affected; those who had disabled the default one-time approval setting were exposed. 0x Labs' own contracts were not compromised.
27 January 2026
Matcha Meta removes SwapNet as an available aggregator, disables the toggle allowing users to turn off one-time approvals, and publishes post-mortem.
Decision Log
- hash: 5ZzxfteG4e8pAQczaKqwJydZfvSBmX1aZMFunoEGDAMZ
- hash: FS3Ep3zjgni42Wwq5XQs8nCHqLjRNWp4TCRebuxnRA5N
- hash: 86RBqtTY2Fqz2ScmZ2oRp6D2gSooQTXVYksxtLSDRqBT
- hash: 54Biv4eUjQQbMXBDTkPrxPLEeoMuicuFga2zMfoaThaP
This investigation is cryptographically anchored to the Solana blockchain (4 events). 14 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:18 AM
last updated: 9/15/2026, 5:10:50 PM
13 viewsavoid.net — verified advice for a post-truth world