86 Gnosis Safe Wallets Drained In $3.2M SquidRouterModule Exploit

On May 25, 2026, blockchain security firm Blockaid detected an active exploit targeting a contract named SquidRouterModule deployed on both Ethereum and Base. Within approximately two hours, 86 Gnosis Safe (now known as Safe) multisig wallets were drained of approximately $3.2 million in USDC, USDT, and ENA tokens. The attacker consolidated all stolen funds into roughly 3.07 million DAI, held in a wallet identified by PeckShield as beginning with 0xa447...54859 on Ethereum. The vulnerability resided in the executeSameChainActions() function of the SquidRouterModule, a third-party add-on that some Safe wallet owners had enabled. The module contained an improper identity validation flaw that accepted a caller-supplied constant string as proof of authorization, effectively allowing anyone who passed that string to execute arbitrary calldata from within victim Safe wallets. The attacker deployed Foundry-based exploit contracts that abused the module's DelegateBundler execution path to impersonate authorized delegates, completely bypassing the multisignature approval requirements that are the core security feature of Safe wallets. Once inside the wallets, the attacker executed a sophisticated laundering sequence. Legitimate tokens held by victims were swapped for a worthless attacker-created token identified as "u," after which the attacker removed liquidity and converted the proceeds into DAI through Uniswap V3 pools. The attacker's initial funding of 2.1 ETH came through Tornado Cash, indicating a deliberately anonymized and premeditated operation. The entire attack from first drain to final consolidation was completed within two hours. Squid Router, the legitimate cross-chain protocol, issued a statement distancing itself from the exploit, confirming that its core protocol and production contracts were not affected. According to Squid, the exploited contract merely shared the SquidRouterModule name and had no connection to Squid's infrastructure. Safe's core smart contract system was also uncompromised; the vulnerability existed solely within the third-party module that some wallet owners had voluntarily enabled. This incident highlights a critical risk in the modular smart wallet ecosystem: third-party modules that extend wallet functionality can introduce severe vulnerabilities, even when the core wallet infrastructure remains secure. Users of Safe and similar modular wallets should audit all enabled modules, revoke permissions for any modules they do not actively use, and verify that any module has undergone a reputable third-party security audit before enabling it. The fact that a module was verified on a block explorer only means its source code is readable, not that it has been audited or is free of vulnerabilities. The SquidRouterModule exploit joins a growing list of DeFi incidents in May 2026 and serves as a reminder that the weakest link in wallet security is often not the wallet itself but the extensions users add to it.