SlowMist Founder Attributes $3.2 Million Exploit to SquidRouterModule Vulnerability in Safe Wallets

SlowMist founder Yu Xian reported on X that a recent security incident involving Squid was caused by a vulnerability in the "SquidRouterModule" within Safe Wallets, rather than compromised private keys. According to Yu, the exploit targeted single-signature Safe wallets on the Base and Ethereum networks that had enabled this specific module. Attackers successfully forged messages to bypass validation checks, triggering unauthorized swap operations that drained funds. Reports indicate approximately $3.2 million was stolen across 86 affected Gnosis Safe wallets that had added the contract as a trusted module. While the contract appears on Basescan as "SquidRouterModule," Squid later clarified that its core protocol was not impacted by this third-party Gnosis Safe-related vulnerability. Yu Xian has since published the attacker's profit-collection addresses to assist in tracking the stolen assets.