Gnosis Pay has released a post-mortem on its June 1 security incident, identifying the root cause as a flaw in ERC-1271 signature validation within the Zodiac module. According to the report, the system only checked the contract’s return value and failed to verify whether the call had actually executed successfully. An attacker exploited this by deploying a contract designed to fail while still returning a value interpreted as “valid,” enabling forged authorization and unauthorized withdrawals from accounts they did not own. The vulnerability was introduced in Zodiac code version 3.4.0 in October 2023 and was patched on June 5. Gnosis Pay said the attacker extracted around $1.5 million across 5,281 wallets, including roughly $641,000 in GNO, $453,000 in EURe, and $399,000 in USDC.e. Another approximately $300,000 remains locked in inaccessible accounts, with recovery options still under review. The team said it will expand its security team, bring in external audits, widen smart contract audit coverage, and has already completed a full product rebuild under v2 to improve security and incident response capabilities.

Gnosis co-founder Martin Koppelmann confirmed the Zodiac delay module used by Gnosis Pay is being exploited, allowing unauthorized transactions from Safe wallets. Gnosis requested bridge validators to halt operations and will cover all user losses, ensuring full reimbursement, while retracting the emergency withdrawal notice.

Blockchain security firm PeckShield has warned of an ongoing attack on Gnosis Pay. Co-founder Martin Köppelmann publicly called for users to immediately withdraw GNO and EURe assets. Market analysts warn of potential selling pressure on GNO and EURe if a fund theft or protocol exploit is confirmed, which could shake the Gnosis ecosystem. Official details are still pending.