A third-party Gnosis Safe module carrying the Squid name was exploited across Ethereum and Base networks, draining approximately $3.2 million from 86 Safes in roughly two hours, according to security firms Blockaid and PeckShield. The vulnerable contract, verified on Basescan under the name 'SquidRouterModule', was not built, deployed, or operated by the cross-chain protocol Squid. The exploit worked by accepting a caller-supplied constant string as proof that a message was secure, allowing attackers to execute arbitrary calldata and spend any tokens held in victim's Safes without signatures. The root cause lies in the design of the third-party Gnosis Safe module itself, which would accept an immutable string provided by the caller as proof of the message's security, with this string clearly visible in the publicly available source code.
The attacker deployed Foundry-based exploit contracts that called the module's DelegateBundler path, impersonating authorized delegates on each Safe and triggering arbitrary swaps through Uniswap V3 pools, as reported by Blockaid. Target assets were swapped through attacker-seeded Uniswap V3 pools into a worthless attacker-created token called 'u'. The attacker then removed liquidity from the pools and consolidated the proceeds into roughly 3.07 million DAI, now held in a wallet beginning '0xA447...54859', according to PeckShield. The exploiter's initial funding of 2.1 ETH came from Tornado Cash. The legitimate Squid Router contract (0xce16F69375520ab01377ce7B88f5BA8C48F8D666) uses a completely different architecture and has not been affected by this attack.
Pseudonymous Squid co-founder Fig wrote on X that 'The contract called SquidRouterModule is unrelated to Squid. We don't know yet who wrote or deployed this.' The project's official X page added that 'The core router was architecturally separate and untouched.' Squid explained that the contract shares the Squid name but is a third-party product that chose to integrate with Squid among other protocols and had no contact with the team. The team made clear that there was nothing related to the core Squid protocol or its contracts regarding this incident, and not all Squid users and integrators are affected. Initial public information could erroneously refer to SquidRouter based solely on the name of the exploited contract available on Basescan.
According to The Block's data dashboard, DeFi has logged more than $770 million in losses in 2026, with April alone setting a record of roughly 30 incidents and more than $630 million drained. Squid recently announced it had raised $6 million in a strategic funding round led by North Island Ventures, with Ripple, Dialectic, and Borderless also participating. The project claims to have completed nine independent security audits to date, recorded no exploits, and maintained 99.99% uptime.
