Blockchain security firm Blockaid has detected an active exploit targeting the SquidRouterModule on Ethereum and Base, resulting in the draining of 86 Gnosis Safes for approximately $3 million within roughly two hours. According to Blockaid's X thread, the exploit specifically targeted Gnosis Safes linked to the SquidRouterModule, with the attack moving quickly to drain dozens of Safes before stolen assets were converted into other cryptocurrencies. Squid has confirmed that its core router contracts and user funds were not affected by the exploit, clarifying that the issue originated from a separate third-party module integrated into some Safe wallets. The attack reportedly exploited a flaw in the module's executeSameChainActions() function, which allowed unauthorized execution inside Safe accounts and gave attackers the ability to impersonate approved delegates.
The attack was possible because affected wallets had previously approved a vulnerable third-party module with broad transaction permissions. As reported by Blockaid, attackers deployed Foundry-based exploit contracts to trigger delegated calls through the vulnerable module, allowing them to perform token swaps directly from victim Safes. The exploit worked because the module accepted a publicly known constant string as proof of authorization, allowing attackers to execute arbitrary transactions without valid wallet signatures. Before launching the attack, the hacker funded their wallet with 2.1 ETH through Tornado Cash and then carried out automated attacks across both the Ethereum and Base networks. The confusion stemmed from the similarity in contract names, which made the vulnerable module appear associated with Squid despite having no direct operational connection to the platform.
The stolen tokens were strategically converted into DAI through attacker-controlled Uniswap V3 pools, as reported by Blockaid. The firm identified the exploiter address as 0x9bdc730183821b6bb2b51be30b77c964fa645b91, which was funded by Tornado Cash and recorded 52 transactions with activity listed on May 25. A consolidation wallet holding the proceeds was identified, showing approximately 3.07 million DAI worth roughly $3.07 million alongside a small ETH balance. The attackers reportedly created a fake token called "u" with a large supply and paired it with real assets inside pre-funded Uniswap V3 liquidity pools. After draining funds from Safes, the attackers removed liquidity from the pools and completed swaps into stablecoins, converting the stolen assets like USDC & USDT into the DAI holdings.
This incident occurs during an active month for onchain security teams, with recent exploits including StablR's EURR and USDR stablecoins losing their pegs after a suspected private key compromise that extracted about $2.8 million. Earlier in May, Blockaid flagged an active smart contract exploit involving ShapeShift's FOX Colony on Arbitrum, which drained $132,700 initially before related exploits pushed total losses to approximately $182,700. The pattern demonstrates attackers increasingly targeting weak points around smart contracts, proxies, bridges, wallets, and key management systems. According to PeckShield data, hackers have stolen about $328.6 million across eight bridge-related exploits this year alone, while separate data from Defillama showed that total crypto losses have exceeded $16.5 billion over time, with cross-chain bridge attacks accounting for roughly $3.22 billion of those losses.
Recent exploit coverage shows attackers continue targeting weak points around smart contracts, proxies, bridges, wallets, and key management systems. According to Crypto.news reports, DefiLlama logged 518 crypto hacks over 10 years with total losses above $17 billion. The latest SquidRouterModule alert adds another case where connected DeFi infrastructure became the attack surface, highlighting the importance of module permissions and Safe integrations for security teams to review and monitor closely. Users who never added or trusted the vulnerable module were not affected, demonstrating the critical need for proper module vetting and permission management in DeFi infrastructure. This incident adds to the growing list of exploits in 2026, emphasizing the need for enhanced security measures across decentralized finance platforms.
