Squid Distances Itself From $3.2 Million Exploit Linked to Third-Party Module

A third-party Gnosis Safe module carrying the Squid name was exploited across Ethereum and Base networks, leading to losses of about $3.2 million from 86 Safes within roughly two hours.

Security firms reported that the affected contract, verified on Basescan as “SquidRouterModule,” was not created, deployed or managed by the cross-chain protocol Squid. The company quickly moved to separate itself from the incident, saying its main protocol and router infrastructure remained untouched.

Squid co-founder Fig stated that the team does not know who built or deployed the contract, despite it using the Squid name.

How the Attack Happened

According to security researchers, the vulnerable module accepted a caller-provided constant string as proof that a transaction was secure. Attackers reportedly used this weakness to execute unauthorized transactions and spend tokens held in affected Safes without approval signatures.

The exploit involved attacker created contracts using a delegate execution path to impersonate approved users and trigger swaps through Uniswap V3 pools.

Stolen assets were converted into an attacker-created token called “u,” before liquidity was removed and converted into around 3.07 million DAI. Security analysts said the funds are now stored in a wallet beginning with “0xa447.”

Squid Says Core Protocol Was Not Affected

Squid clarified that public reports linking the exploit directly to its platform were misleading. The team said the module was developed independently by a third party that integrated Squid alongside other protocols.

The incident adds to growing DeFi security concerns, with crypto losses from hacks reportedly surpassing $770 million in 2026 so far.