Matcha:
a genuinely long, clean core history from 0x Labs, with a real incident that landed on its edges.
We tore apart Matcha, the DEX aggregator built by 0x Labs, across the same aggregator-adapted scorecard we've used throughout this series. From a genuinely long, well-audited core history, 0x's own contracts have operated without a major exploit since 2017, broad routing across 16 EVM chains and 100+ exchanges, a genuinely distinctive commitment to never retaining the gap between an expected and executed price, and gasless limit orders settled by a professional taker network, to a real, significant, well-corroborated incident worth presenting with precision: in late January 2026, an integrated third-party aggregator called SwapNet was exploited for roughly $13.4-16.8 million (sources vary), affecting users who had granted it direct, ongoing token approvals. We found this reported under the name "Matcha Meta," a closely related but not confirmed-identical product to the base Matcha service; multiple sources confirm 0x's own core AllowanceHolder and Settler contracts, underpinning Matcha's One-Time Approval system, were unaffected, and users who used that system were not exposed; and landed on a score the marketing page won't show you.
Our take, up front: Matcha is the DEX aggregator built by 0x Labs, aggregating price and liquidity across more than 100 exchanges and 16 EVM chains, with a genuinely long operating history: 0x's core contracts, audited by named firms including Trail of Bits and ConsenSys Diligence, have operated without a major exploit since 2017. Real, genuinely distinctive commitment to full price transparency, disclosed as never retaining the difference between an expected and executed price. Real, genuinely distinctive gasless limit orders, settled by a professional taker network rather than requiring the user to hold native gas, and gasless swaps on supported chains where fees are taken from the traded token. Real, genuinely distinctive Matcha Auto mode with disclosed MEV protection and accelerated block inclusion for more reliable execution. Real, genuinely non-custodial architecture, and a consistently praised interface, described across multiple independent sources as one of the cleanest in DeFi. What we can't set aside: a real, significant, well-corroborated recent incident, though we want to present it with real precision about exactly what it did and didn't involve. In late January 2026, an integrated third-party aggregator called SwapNet was exploited via an arbitrary-call vulnerability, draining roughly $13.4-16.8 million (figures vary by source) from users who had granted it direct, ongoing token approvals. We found this incident reported under the name "Matcha Meta," a closely related product built by the same 0x team but not confirmed to be identical to the base Matcha service we're reviewing here; we're disclosing this naming ambiguity directly rather than either ignoring the incident or overstating its connection. Real, genuinely important, well-corroborated distinction across nearly every source we found: this incident was confirmed unrelated to 0x's own core AllowanceHolder and Settler contracts, which underpin Matcha's One-Time Approval system, and users who had adopted that system specifically were not affected. Real, genuinely positive, disclosed response: the option to grant direct, ongoing approvals to third-party aggregators was removed from the interface entirely following the incident. Real, honest, notable discrepancy across our sources on Matcha's exact fee model, with some describing zero platform fees beyond network gas and others describing a modest, disclosed aggregator fee shown before confirmation. We weighted all of it below.
Real, genuinely long, clean core-protocol history: 0x's core contracts, audited by named firms including Trail of Bits and ConsenSys Diligence, have operated without a major exploit since 2017. Real, genuinely important, well-corroborated, recent incident: in late January 2026, an integrated third-party aggregator, SwapNet, was exploited via an arbitrary-call vulnerability, draining $13.4-16.8 million (sources vary) from users who had granted it direct, ongoing token approvals. Real, genuinely important distinction confirmed across nearly every source we found: this incident was unrelated to 0x's own core AllowanceHolder and Settler contracts, and users who had adopted Matcha's One-Time Approval system specifically were not affected. Real, genuinely positive, disclosed response: the option to set direct, ongoing approvals to third-party aggregators was removed from the interface entirely following the incident.
Pros
- 0x's core contracts unexploited since 2017, per named-firm audits
- Core AllowanceHolder/Settler contracts confirmed unaffected by the 2026 incident
- Direct, ongoing third-party approvals removed from the interface after the incident
Cons
- Jan 2026: $13.4-16.8M SwapNet exploit affecting users who opted out of One-Time Approvals
Real, genuinely broad, well-documented EVM coverage: 16 chains, more than 100 exchanges, and 9 million-plus tokens routed through, per detailed sources. Real, genuinely distinctive commitment to full price transparency, disclosed as never retaining the difference between an expected and executed price. Real, genuinely distinctive Matcha Auto mode with disclosed MEV protection and accelerated next-block inclusion for more reliable execution.
Pros
- 16 EVM chains, 100+ exchanges, 9M+ tokens routed through
- Disclosed commitment to never retaining expected-vs-executed price differences
Cons
- EVM-only; no Solana, Bitcoin, Cosmos, or Move-chain routing
Real, genuinely non-custodial; funds remain in a user's wallet throughout. Real, disclosed ZRX governance token. Real, genuinely long operating history under one team (0x Labs) since 2017, a positive contrast to some newer, less-established platforms in this series.
Pros
- Genuinely non-custodial; disclosed ZRX governance
- Long, continuous operating history under one team since 2017
Cons
- Less specific, detailed tokenomics disclosure than some other platforms in this series
Real, genuinely broad coverage across 16 EVM-compatible chains and more than 100 exchanges. Real, honest, disclosed scope limitation: not currently available on Solana, Bitcoin, Cosmos, or Move-based chains like Aptos or Sui.
Pros
- Broad, deep coverage across 16 EVM chains and 100+ exchanges
Cons
- No Solana, Bitcoin, Cosmos, or Move-chain support
Real, genuinely well-corroborated, consistently praised interface, described across multiple independent sources as one of the cleanest in DeFi. Real, genuinely distinctive gasless limit orders and gasless swaps on supported chains, with fees taken from the traded token rather than requiring native gas.
Pros
- Consistently praised across multiple sources as one of the cleanest interfaces in DeFi
- Gasless limit orders and gasless swaps on supported chains
Cons
- Users must actively choose One-Time Approvals to get the safest configuration
Real, honest, notable discrepancy across our sources: some describe Matcha as charging zero platform fees with only network gas applying, while others describe a modest, disclosed aggregator fee shown in the quote panel before confirmation. Real, disclosed commitment to full fee transparency regardless of the exact model.
Pros
- Disclosed, transparent fee-quoting shown before every trade confirmation
- Free limit order placement and cancellation
Cons
- Real, unresolved discrepancy across sources on the exact platform fee model
Real, genuinely distinctive gasless limit orders settled by a professional taker network. Real, Matcha Auto mode with MEV protection and accelerated block inclusion. Real, broad multi-DEX and RFQ market-maker liquidity access in one interface.
Pros
- Gasless limit orders via professional taker network; Matcha Auto's MEV protection
- Combined AMM and RFQ market-maker liquidity access
Cons
- None significant found in our research
Access only through matcha.xyz directly, and specifically choose One-Time Approvals rather than direct, ongoing allowances.
Given the January 2026 incident specifically affected users who granted direct, ongoing approvals to a third-party aggregator, use One-Time Approvals whenever offered, and revoke any old, unlimited approvals you may have set previously.
A genuinely long, clean core history, with a real incident that landed exactly where we'd expect for this category.
Matcha earns real credit for something genuinely rare in crypto years: 0x's core contracts have run since 2017 without a major exploit, a track record longer than most of the platforms in this entire project have existed. That's a real, substantive foundation. The January 2026 incident doesn't erase that; it actually illustrates, almost perfectly, the exact structural risk we flagged when we opened this aggregator series with 1inch: your security is only as strong as the weakest third party you route through, or in this case, approve directly. The fact that One-Time Approval users were untouched, and that Matcha removed the riskier option afterward, tells us the underlying design was sound even when a specific integration wasn't. We also want to be transparent that we found this incident reported under a closely related name, "Matcha Meta," and we're disclosing that naming question directly rather than either burying the incident or overstating the connection with false certainty.
The scorecard above is deliberately general. Whether Matcha is right for you depends heavily on which of these you already are.
The EVM trader who wants broad chain coverage, a clean interface, and a genuinely long, trustworthy core protocol history
This is genuinely where Matcha's real, well-corroborated strengths concentrate most heavily.
The trader who wants gasless limit orders or gasless swaps when arriving on a new chain
These are genuinely distinctive, real conveniences most other aggregators in this series don't offer as cleanly.
The user who specifically selects One-Time Approvals rather than direct, ongoing allowances
Given exactly what the January 2026 incident affected, this specific choice genuinely matters here.
Traders needing non-EVM chains like Solana or Bitcoin, reviewed via Jupiter or THORChain earlier in this series
Matcha's EVM-only scope makes this a real, honest consideration for that specific need.
The scorecard covers the headline judgment calls. These four tables cover the specifics we didn't want to bury in prose; the "Matcha" vs. "Matcha Meta" naming question presented transparently, the January 2026 SwapNet incident explained precisely, the fee-model discrepancy across sources, and our first eight-way aggregator comparison.
"Matcha" vs. "Matcha Meta," presented transparently
| Detail | |
|---|---|
| What we set out to review | Matcha, the DEX aggregator built by 0x Labs |
| What the incident reports named | "Matcha Meta," described by multiple sources as "built by 0x" and functioning as a meta-aggregator |
| What we could confirm | A close relationship (same team, same core 0x contracts referenced); not a confirmed, exact identity match |
| What we did | Disclosed this ambiguity directly rather than silently merging or silently excluding the incident |
We're being transparent about this because getting a platform's identity right matters as much as getting its facts right; we'd rather show our work than quietly guess.
The January 2026 SwapNet incident, precisely
| Detail | |
|---|---|
| Root cause | An arbitrary call in the SwapNet contract allowed transfer of funds users had already approved |
| Amount | $13.4-16.8 million (sources vary; The Block's corrected figure is $13.43M, PeckShield-sourced reports cite $16.8M) |
| Who was affected | Users who granted direct, ongoing approvals to SwapNet specifically |
| Who was unaffected | Users who used Matcha's One-Time Approval system, routed through 0x's AllowanceHolder/Settler contracts |
| Response | Direct, ongoing third-party approvals removed from the interface entirely |
This is a genuinely clear, real-world example of the compounded third-party risk we flagged as a category-defining concern when we opened this aggregator series with 1inch.
The fee-model discrepancy, presented transparently
| Source claim | Detail |
|---|---|
| "Zero platform fees" | Only network gas applies, per at least one detailed source |
| "Modest aggregator fee" | Disclosed in the quote panel before confirmation, per another detailed source |
We'd recommend checking the quote panel directly before confirming any trade; Matcha's own disclosed practice is to show the exact fee upfront regardless of which general model applies.
Eight aggregators, side by side
| 1inch | Jupiter | Rubic | KyberSwap | Rango | Velora | CoW Swap | Matcha | |
|---|---|---|---|---|---|---|---|---|
| Live since | 2019 | 2021 | 2020 | 2017 | 2021 | 2019 (as ParaSwap) | 2021 | 2017 |
| Confirmed incidents | One | One | Two | One | None found | None found | Two | One (naming caveat noted) |
| Chain scope | 13+ | Solana-only | Disputed, wide | 17-25 | 50-74+ (disputed) | Cross-chain focus | 2 (EVM-only) | 16 (EVM-only) |
Matcha and 0x's core protocol share the longest continuous operating history of any aggregator in this comparison, dating back to 2017.
We don't just want to hand you our number; we want to show you how it sits next to what other review desks and comparison sites have published. We've excluded two generic, low-detail directory listings (Slashdot, SourceForge) and all incident-specific news reports covering the January 2026 SwapNet exploit, since those are postmortems rather than general reviews.
Our score lands close to the aggregated industry average, one of the smaller gaps we've found in this specific batch of reviews; the genuinely long, clean core-protocol history and thoughtful UX we weighted heavily are the same qualities most independent sources single out favorably.
| Source | Score | Type |
|---|
Scores compiled by our editorial team from publicly available reviews as of August 2026. "Editorial estimate" means the outlet didn't publish a single numeric score, so we converted their published verdict and sentiment into a comparable 100-point figure. Verify current figures directly with each source before citing them elsewhere.
0x's own core contracts have run without a major exploit since 2017. In late January 2026, an incident reported under the name "Matcha Meta" involved a third-party integration called SwapNet, draining $13.4-16.8 million from users who had granted it direct, ongoing approvals; 0x's own core contracts were confirmed unaffected.
We couldn't fully confirm this. Multiple sources describe "Matcha Meta" as built by 0x and functioning as a meta-aggregator, but we didn't find confirmation that it's the exact same product as the base Matcha service. We're disclosing this directly rather than guessing.
A system routing token permissions through 0x's AllowanceHolder and Settler contracts, granting approval for a single transaction rather than an ongoing allowance. Users who used this system were not affected by the January 2026 SwapNet incident.
16 EVM-compatible chains, including Ethereum, Polygon, BNB Smart Chain, Avalanche, Optimism, Arbitrum, and Base. It does not currently support Solana, Bitcoin, Cosmos, or Move-based chains like Aptos or Sui.
Our sources disagree on the exact model: some describe zero platform fees with only network gas applying, others describe a modest, disclosed aggregator fee. Either way, Matcha shows the exact fee in the quote panel before you confirm any trade.
Orders created as signed off-chain messages that cost no gas to place or cancel. When the market price hits your trigger, a professional taker network fills the order on-chain and pays the gas, not you.
0x Labs, the team behind the 0x Protocol, which has operated continuously since 2017, one of the longer-running teams in this entire aggregator series.
A trading mode with disclosed MEV protection and accelerated next-block inclusion, designed to make execution more reliable for time-sensitive trades.
More Reviews
1inch – DEX Aggregator Review
Score: 75/100. Category-defining aggregator; a Mar 2025 resolver incident (~$5M) didn't touch user funds, but did touch trust.
Read More
Jupiter – DEX Aggregator Review
Score: 78/100. Highest score in this whole project: ~95% Solana share, with the one 2024 phishing incident purely user-side.
Read More
Rubic – DEX Aggregator Review
Score: 51/100. Lowest in this sub-series: two 2022 hacks and unresolved, wide gaps in its own claimed audit scope.
Read More
KyberSwap – DEX Aggregator Review
Score: 63.5/100. Dual aggregator+AMM; the Nov 2023 Elastic exploit left the aggregator itself confirmed unaffected.
Read More