A security incident tied to SwapNet, a router used by Matcha Meta, triggered a rapid on-chain drain and a fast-moving narrative battle over who should have stopped what.
Matcha Meta publicly acknowledged the incident and said SwapNet temporarily disabled affected contracts, with the warning focused on users who had turned off one-time approvals and manually approved SwapNet contracts. Shortly after, PeckShield estimated roughly $16.8 million in assets were drained and noted the attacker swapped about $10.5 million in USDC into ETH on Base before bridging out.
CertiK’s initial technical framing pointed to an “arbitrary call” style issue that could allow an attacker to move funds already approved to the SwapNet contract, which fits the broader “approval hygiene” theme now spreading across social timelines.
That set the stage for the centralization angle. In a separate post, on-chain investigator ZachXBT criticized Circle’s response speed and highlighted a specific address he claimed still held about $3 million USDC that could be frozen.
The controversy lands in a sensitive spot for DeFi. USDC is widely used precisely because it is regulated and operationally mature, but that maturity includes issuer controls. Circle’s own legal language for USDC explicitly describes “blocked addresses” and the possibility of freezing USDC under certain circumstances.
In practice, this power can look like a safety net when stolen funds remain on a chain and within the issuer’s reach. It can also look like an uncomfortable form of discretionary enforcement when the market expects action and does not get it, or when actions appear uneven across incidents.
The ZachXBT critique pushes that tension into a simple headline: if a centralized issuer can freeze, should it be expected to freeze, and if it does not, what does that say about building critical DeFi UX on top of a token with centralized controls.
Two concrete questions are driving the next wave of discussion.
First is attribution of the exact exploit path: which contract(s) were exploited and what approval pattern enabled the drain. If the core mechanic is “approved funds plus arbitrary execution,” then wallet and aggregator defaults become part of the security boundary, not just the protocol code.
Second is the issuer-action timeline: whether any addresses were frozen, when those actions occurred (if at all), and what value was actually prevented from moving. The focus is likely to stay on any USDC that remains on Base versus funds already bridged away. This is also where narrative can outrun facts, so the most defensible updates tend to come from clear contract-level events and explorer-confirmable changes.
If the “approval UX” angle keeps winning, more wallets and aggregators are likely to push users toward scoped approvals by default, with clearer prompts and automated revocation flows. That approach does not remove smart contract risk, but it can shrink the blast radius when a router or downstream contract breaks.
For builders, the incident is also a reminder that choosing stablecoins is not only about liquidity and integrations. It is also about governance assumptions and incident-response expectations. USDC’s issuer controls can be seen as risk reduction or as systemic dependency, and which framing dominates often depends on the next high-profile incident and how quickly funds can be contained.
The SwapNet incident is turning into more than an exploit recap. It is becoming a stress test for how DeFi allocates responsibility across protocol code, wallet permissions, and stablecoin issuer controls.
ZachXBT’s criticism of Circle turns the spotlight onto a long-running trade-off: centralized powers can sometimes limit damage, but they also introduce a trust and expectation layer that can reshape narratives, product decisions, and user behavior overnight.
The post ZachXBT Calls Out Circle After SwapNet Exploit, Reigniting USDC Centralization Debate appeared first on Crypto Adventure.
Also read: Oil Prices Rise as Winter Storm Cuts US Crude Production by 250,000 Barrels Daily
