Ethereum

Uniswap

Tornado Cash

Tornado

Gnosis

<p><strong>Blockaid said it detected an active exploit targeting the SquidRouterModule on Ethereum and Base, with 86 Gnosis Safes drained for about $3 million in roughly two hours.</strong></p>
<div id="cn-block-summary-block_3230488f68cb4bcb2e0c875d144e30b5" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Blockaid said 86 Gnosis Safes were drained for about $3 million within roughly two hours.</li>
   <li>The attacker swapped stolen assets into DAI through attacker-controlled Uniswap V3 pools, Blockaid said.</li>
   <li>Related crypto.news coverage shows May has brought repeated DeFi exploits across wallets, bridges, and stablecoins.</li>
  </ul>
 </div>
</div>
<p>The blockchain security firm said the stolen tokens were swapped into DAI through attacker-controlled Uniswap V3 pools. The alert listed an exploiter address, a consolidation wallet, and one example drain transaction.</p>
<p>According to Blockaid’s X thread, the exploit targeted Gnosis Safes linked to the SquidRouterModule. The firm said the attack moved quickly, draining dozens of Safes before the stolen assets were converted.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>🚨 Blockaid detected an ongoing exploit targeting the SquidRouterModule on Ethereum and Base.<br><br>86 Gnosis Safes drained for ~$3M in ~2 hours. <br>All stolen tokens swapped to DAI via attacker-controlled Uniswap V3 pools.<br>More details in 🧵</p>— Blockaid (@blockaid_) <a href="https://twitter.com/blockaid_/status/2058875782810726556?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 25, 2026</a>
  </blockquote>
 </div>
</figure>
<p>The alert <a href="https://t.co/9yXiytAzDN" rel="noopener noreferrer nofollow">identified</a> the exploiter address as 0x9bdc730183821b6bb2b51be30b77c964fa645b91. Etherscan data shows that address was funded by Tornado Cash and recorded 52 transactions, with activity listed on May 25.</p>
<p>You might also like: <a href="https://crypto.news/blackrock-dumps-1b-bitcoin-as-etf-outflows-hit-yearly-high/" rel="noopener noreferrer nofollow"> BlackRock dumps $1B Bitcoin as ETF outflows hit yearly high </a></p>
<p>Blockaid also pointed to a consolidation wallet holding the proceeds. Etherscan data for that wallet <a href="https://etherscan.io/address/0xa447f71782135ab96a71374271a749ff7aa54859" rel="noopener noreferrer nofollow">showed</a> about 3.07 million DAI, worth roughly $3.07 million, alongside a small ETH balance.</p>
<figure class="wp-block-image size-large"><img width="1024" height="502" src="https://media.crypto.news/2026/05/image-195-1024x502.webp" alt="Source: Etherscan">
 <figcaption>
  Source: Etherscan
 </figcaption>
</figure>
<h2 class="wp-block-heading" id="strong-stolen-tokens-move-through-uniswap-v3-strong"><strong>Stolen tokens move through Uniswap V3</strong></h2>
<p>The example transaction <a href="https://t.co/RaL8OaTHB9" rel="noopener noreferrer nofollow">shared</a> by Blockaid succeeded at 06:25:23 UTC on May 25. Etherscan shows the transaction came from the exploiter address and interacted with another address tied to the reported flow.</p>
<p>The same transaction page shows swaps involving USDC, ENA, and USDT through Uniswap V3 pools. These details match Blockaid’s claim that stolen assets were routed through decentralized exchange pools before being consolidated.</p>
<p>In response, Squid later said the incident was unrelated to its core protocol and contracts. The team said all Squid users and integrators were unaffected and no action was needed. According to Squid, the exploited contract was a third-party Gnosis Safe module verified on Basescan as “SquidRouterModule,” but it was not built, deployed, or operated by Squid.</p>
<p>Squid said the exploit came from a faulty third-party smart-wallet module that victims had added as a trusted Safe Module. The team added that its official router contract was architecturally different and was not touched.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>This incident is unrelated to Squid’s core protocol and contracts. All Squid users and integrators are unaffected and no action is needed.<br><br>A third-party Gnosis Safe module was exploited today across Base and Ethereum, resulting in approximately $3.2M in losses. The vulnerable… <a href="https://t.co/I3gGmdBvE9" rel="noopener noreferrer nofollow">https://t.co/I3gGmdBvE9</a></p>— squid (@squidrouter) <a href="https://twitter.com/squidrouter/status/2058890710611276238?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 25, 2026</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="strong-may-exploit-wave-keeps-security-teams-active-strong"><strong>May exploit wave keeps security teams active</strong></h2>
<p>The SquidRouterModule incident comes during an active month for onchain security teams. Crypto.news <a href="https://crypto.news/stablr-depeg-shock-hits-eurr-and-usdr-after-2-8m-exploit-warning/" rel="noopener noreferrer nofollow">reported</a> one day earlier that StablR’s EURR and USDR stablecoins lost their pegs after a suspected private key compromise let an attacker take control of minting permissions and extract about $2.8 million.</p>
<p>That report said Blockaid traced the StablR incident to a compromised multisig owner. The attacker reportedly minted 12.85 million tokens and converted thin DEX liquidity into 1,115 ETH in proceeds.</p>
<p>Crypto.news also <a href="https://crypto.news/blockaid-warns-of-active-smart-contract-exploit/" rel="noopener noreferrer nofollow">reported</a> earlier in May that Blockaid flagged an active smart contract exploit involving ShapeShift’s FOX Colony on Arbitrum. That incident drained $132,700 at first, before a related exploit pushed total losses to about $182,700.</p>
<h2 class="wp-block-heading" id="strong-defi-infrastructure-risks-remain-in-focus-strong"><strong>DeFi infrastructure risks remain in focus</strong></h2>
<p>Recent exploit coverage shows attackers keep targeting weak points around smart contracts, proxies, bridges, wallets, and key management. Crypto.news reported in April that DefiLlama had <a href="https://crypto.news/crypto-hacks-top-17b-in-a-decade-as-attackers-pivot-from-code-to-keys/" rel="noopener noreferrer nofollow">logged</a> 518 crypto hacks over 10 years, with total losses above $17 billion.</p>
<p>The same report said recent incidents show attackers increasingly target private keys, signing systems, bridges, and wallets, not only smart contract code. That pattern makes module permissions and Safe integrations an important area for teams to review.</p>
<p>Crypto.news also reported that TrustedVolumes <a href="https://crypto.news/trustedvolumes-confirms-6-7-million-exploit-seeks-constructive-talks-with-hacker/" rel="noopener noreferrer nofollow">lost roughly $6.7 million</a> in an exploit tied to a custom RFQ swap proxy. Blockaid and other firms said about $5.87 million was drained from the protocol’s Ethereum resolver.</p>
<p>The latest SquidRouterModule alert adds another case where connected DeFi infrastructure became the attack surface.</p>
<p>Read more: <a href="https://crypto.news/polymarket-blocked-in-indonesia-as-prabowo-exit-bets-spark-heat/" rel="noopener noreferrer nofollow"> Polymarket blocked in Indonesia as Prabowo exit bets spark heat&nbsp; </a></p>

Blockaid flags $3M SquidRouterModule exploit across 86 Safes

Table of Contents

crypto.news

Other articles published on May 25, 2026

Join our free newsletter for daily crypto updates!