What happened
On May 25, 2026, a third-party Gnosis Safe module named SquidRouterModule was exploited across Ethereum and Base, draining roughly $3.2 million from 86 Safes. Squid stated that it neither built nor deployed the module and that its core router was unaffected.
According to the reported analysis, the third-party module treated a caller-supplied constant string as authorization and then allowed arbitrary calldata through its delegated execution path. This was not a vulnerability in Safe's core contracts or Squid's core router.
Case & protocol details
Attack Timeline
Reporting says the attacker supplied the publicly readable constant to pass the module's authorization check, then used its delegate-execution path to move assets from Safes that had enabled the module without owner signatures. The stolen assets were reportedly swapped through attacker-controlled Uniswap V3 pools and consolidated into DAI.
Evidence & learning
Attack pattern
Compare incidents →Proof of concept
1 availableSources and on-chain records
- report Report x.com
- report Report x.com
- analysis Website reference t.me
- analysis The Block: SquidRouterModule third-party module exploit theblock.co
- analysis SigIntZero: SquidRouterModule exploit analysis sigintzero.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.