<\/p>\n
Squid has moved quickly to stress that a recent $3 million exploit targeted a third party Gnosis Safe module called SquidRouterModule, not its core cross chain routing contracts, after 86 wallets on Ethereum and Base were drained in under two hours.<\/p>\n
<\/p>\n
According to on chain security firm Blockaid, the attack centered on a Gnosis Safe module named SquidRouterModule deployed on Ethereum and Base, which was used by some multisig owners to route cross chain transactions involving Squid and other protocols.<\/p>\n
Blockaid reported that over roughly two hours the attacker siphoned funds from 86 Gnosis Safe wallets, with total losses of about $3 million to $3.2 million, before consolidating the proceeds into a single address holding just over 3.07 million DAI.<\/p>\n
In a detailed summary, KuCoin\u2019s news desk cites Blockaid and Squid as saying the stolen tokens were swapped into DAI via a custom Uniswap V3 pool set up by the attacker, who then aggregated the drained funds into one wallet to simplify laundering.<\/p>\n
The core bug sat inside the SquidRouterModule\u2019s \u201cmessage security\u201d logic: Binance Square coverage explains that the module simply accepted a constant string provided by the caller as proof that a message was valid, which meant anyone who could see the contract code could copy the string and pass arbitrary call data.<\/p>\n
CoinNess reports that the attacker exploited this public fixed string verification to execute arbitrary calls from the affected Safes, effectively granting themselves permission to move assets out of the multisigs without owner confirmation.<\/p>\n
Binance\u2019s incident note describes it bluntly, saying the design \u201caccepted a fixed string provided by the caller for message security,\u201d a pattern that eliminated any real authentication and opened a direct path for draining funds from integrated wallets.<\/p>\n
This is a known class of risk for Gnosis Safe modules, as earlier research by OpenZeppelin showed that any attached module can execute transactions from a wallet without owner approval if its internal checks are weak or misconfigured.<\/a><\/p>\n In this case, the unsafe module was branded with the Squid name but was developed and deployed by a third party integrator, not by the Squid team or its core protocol maintainers.<\/p>\n In an official X post, Squid stated that \u201cthis incident is unrelated to Squid\u2019s core protocol and contracts,\u201d and emphasized that its main routing contract, identified on chain as 0xce16F69375520ab01377ce7B88f5BA8C48F8D666, \u201cwas not involved in any of the malicious transactions.\u201d<\/p>\nWhy is Squid distancing its core router from the hack?<\/h2>\n