Third-Party Module Exploit Drains $3.2M from 86 Gnosis Safe Wallets

A third-party module labeled SquidRouterModule was exploited on the Ethereum and Base networks, draining approximately $3.2 million from 86 Gnosis Safe wallets within roughly two hours, security firms Blockaid and PeckShield reported. The attack targeted multisignature wallets that had previously authorized the module, allowing the attacker to bypass signature verification and transfer tokens without owner approval.

The cross-chain protocol Squid quickly distanced itself from the incident. "The contract called SquidRouterModule is unrelated to Squid. We don't know yet who wrote or deployed this," pseudonymous Squid cofounder Fig wrote on social media. Squid stated that its core router contract was architecturally separate and unaffected. The module, verified on Basescan under the SquidRouterModule name, was built and deployed by an unidentified third party that had integrated with Squid and other protocols without prior coordination with the Squid team, according to the project.

Investigators identified the root cause as a flaw in the module's authentication logic. The contract accepted a constant string supplied by the caller as proof that a message was secure. Because that...