Third-party Gnosis Safe Module (SquidRouterModule)
Hack or exploit on May 25, 2026 · Smart Contract Vulnerability
What happened
A third-party Gnosis Safe module named SquidRouterModule was exploited, draining approximately $3-3.2 million from 86 Gnosis Safe wallets on Ethereum and Base within about 2 hours. The module has no affiliation with the official Squid Router protocol—confusion arose solely due to the contract name on Basescan. Victims had previously added this faulty third-party module as a trusted Safe Module, granting it permission to spend any tokens without signatures. The attacker exploited weak authentication (accepting a publicly visible constant string as "message security" proof) to execute arbitrary calldata, forcing fake Uniswap V3 swaps (real tokens for worthless 'u' token in attacker-controlled pools) and draining funds, which were consolidated into ~3.07M DAI. Squid confirmed its core router and user funds/integrations remain fully secure.
Details
- Date
- May 25, 2026
- Kind
- Hack or exploit
- Method
- Smart Contract Vulnerability
- How in
- Smart contract bug
- Target
- Wallet
- Chains
- Ethereum
Reported by
Related incidents
SquidRouterModule 2026 · Hack or exploit · $3.2M
Fake Safe Token (SAFE) 2024 · Rug pull · $753K
Users of the Safe Wallet lose cumulative $2 million to address poisoning 2023 · Hack or exploit · $5M
NFT developers rugpull for a third time, this time with "Big Daddy Ape Club" 2022 · Rug pull · $1.2M
SwanBluechip, "Third-party Gnosis Safe Module (SquidRouterModule) hack, May 25, 2026: $3.2M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht24a8ce1cbe/ (data as of 2026-11-01).