On May 25, 2026, a security exploit targeting Base and Ethereum wallets siphoned approximately $3.2 million from 86 Gnosis Safe wallets. Leading blockchain security firms PeckShield and Blockaid quickly identified and analyzed the attack vector.
Attack Method: TornadoCash Funding, Uniswap V3 Conversion
According to PeckShield, the attacker first obtained 2.1 ETH through TornadoCash, then swiftly converted the stolen assets into nearly 3 million DAI via Uniswap V3 pools. All loot was deposited into a wallet starting with 0xA447. The core vulnerability lay in the SquidRouterModule smart contract, which accepted an immutable string from the caller as a security proof — a string visible in open-source code, allowing hackers to bypass checks.
Why 86 Wallets Fell So Fast: Pre-Authorized Module Bypassed Signatures
Blockaid’s analysis revealed that victims had previously whitelisted SquidRouterModule as a “trusted Safe module”, meaning it could execute transfers without requiring additional signatures. This backdoor enabled the hacker to drain any amount from each wallet in rapid succession. The official Squid Router contract, which uses a completely different architecture, was not affected.
Squid Router Clarifies: Third-Party Module, Not Ours
The official Squid Router account issued a statement clarifying that the compromised module was neither developed, deployed, nor maintained by Squid. It belonged to an unrelated third-party wallet provider aiming for integration with Squid and other projects. The core Squid protocol and its contracts remain secure; Squid users face no risk. The team urged correct attribution to avoid confusion due to similar names.
CZ Issues Security Alert: Check Your API Keys
Following the incident, Binance founder Changpeng Zhao (CZ) warned developers about the rising threat of software supply chain vulnerabilities. He emphasized that API keys embedded in code for trading bots, DeFi apps, and analytics platforms — even when stored in private repositories — can pose risks if leaked. CZ urged regular review and rotation of such keys.