Incident Overview
On May 25, 2026, a malicious third-party smart contract module titled "SquidRouterModule" was exploited, resulting in the theft of approximately $3.2 million from 86 Gnosis Safe wallets on Ethereum and Base. The module was not affiliated with the official Squid Router protocol, despite the misleading name.
The vulnerability stemmed from a broken authentication check in the module, which accepted a publicly visible constant string as proof that a transaction was secure. By passing this simple string, an attacker was able to trigger the module’s execution functions and perform arbitrary actions. The attacker used this access to force the victim wallets into executing Uniswap V3 swaps, trading legitimate high-value tokens for a worthless token they had pre-deployed.
Once the swaps were processed, the attacker removed the liquidity from these pools and consolidated the proceeds into approximately 3.07 million DAI. Because the module acted as a trusted "Safe Module," the transfers occurred without triggering any of the wallet's standard multi-signature safety requirements.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Third-party SquidRouterModule, these are the critical security checks that could have prevented this incident (May 2026).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Proof-of-Concept Exploits
On-Chain Evidence & References
- Reference https://t.me/defimon_alerts/3045
Sources & References
Learn to Prevent the Next Third-party SquidRouterModule
The Third-party SquidRouterModule hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.