Safe

Zodiac

Gnosis

<p><strong>Gnosis Pay users were urged to withdraw funds after an active exploit linked to the platform’s Zodiac delay module, according to posts from Gnosis co-founder Martin Köppelmann and blockchain security firm PeckShield.</strong></p>
<div id="cn-block-summary-block_4bb2da657fc8b36c46c03d1616a71301" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Gnosis Pay users were told to withdraw EURe and GNO after a delay module exploit.</li>
   <li>Köppelmann said the bug lets an attacker initiate transactions from Safes using the module.</li>
   <li>Gnosis said it would cover user losses while asking bridge validators to pause activity.</li>
  </ul>
 </div>
</div>
<p>“If you are a Gnosis Pay user – unfortunately I have to recommend: withdraw all funds (EURe and GNO),” Martin Köppelmann said on X.</p>
<p>He said the delay module has a bug and warned that users “might be affected.” The post told users to move both EURe and GNO from Gnosis Pay while the team worked on the issue.</p>
<p>“Users are strongly urged to withdraw all funds (EURe and GNO),” PeckShield said in a separate alert.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p><a href="https://x.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a><a href="https://x.com/koeppelmann?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@koeppelmann</a> has alerted that there is an active exploit related to <a href="https://x.com/gnosispay?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@gnosispay</a>. <br><br>Users are strongly urged to withdraw all funds (EURe and GNO). Please check your exposure, as you may be affected. <a href="https://t.co/jiH3okIhLH" rel="noopener noreferrer nofollow">https://t.co/jiH3okIhLH</a></p>— PeckShield <a href="https://x.com/PeckShieldAlert/status/2061372084589371581?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 1, 2026</a>
  </blockquote>
 </div>
</figure>
<p>The blockchain security firm said Köppelmann had warned about an active exploit related to Gnosis Pay. It also told users to check their exposure because they may be affected.</p>
<p>You might also like: <a href="https://crypto.news/ecbs-schnabel-says-digital-euro-needed-as-stablecoin-market-nears-300b/" rel="noopener noreferrer nofollow"> ECB’s Schnabel says digital euro needed as stablecoin market nears $300B </a></p>
<h2 class="wp-block-heading" id="strong-zodiac-delay-module-bug-tied-to-attack-strong"><strong>Zodiac delay module bug tied to attack</strong></h2>
<p>“The bug is related to the Zodiac delay module,” Köppelmann said in a later update.</p>
<p>He said the attacker can initiate transactions from Safes that use the delay module. The update gave more detail on the technical source of the exploit after the first warning referred only to a delay module bug.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>The bug is related to the "Zodiac delay module". The attacker is able to initiate tx from Safes with such a delay module. We are doing various measures to contain the damage like asking bridge validators to pause.<a href="https://t.co/blaDkLpnuF" rel="noopener noreferrer nofollow">https://t.co/blaDkLpnuF</a></p>— koeppelmann (@koeppelmann) <a href="https://x.com/koeppelmann/status/2061376468446257630?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 1, 2026</a>
  </blockquote>
 </div>
</figure>
<p>Gnosis Pay uses Safe-based accounts with smart contract modules. Its own documentation says Gnosis Pay accounts use a Delay Module and a Roles Module to support card payments while keeping users in control of their accounts.</p>
<p>The Delay Module is designed to place a short wait before outgoing transactions can execute. In normal use, that gives users time to react before certain transfers are completed.</p>
<h2 class="wp-block-heading" id="strong-gnosis-moves-to-contain-damage-strong"><strong>Gnosis moves to contain damage</strong></h2>
<p>“We are doing various measures to contain the damage like asking bridge validators to pause,” Köppelmann said.</p>
<p>The statement shows that Gnosis is working with outside infrastructure providers while it responds to the exploit. Bridge validators can play a role in cross-chain movement, so a pause may help slow further movement of affected funds.</p>
<p>“Rest assured, Gnosis will cover all user losses,” Köppelmann <a href="https://x.com/koeppelmann/status/2061362219984568719?s=20" rel="noopener noreferrer nofollow">said</a>.</p>
<p>No final loss figure had been published at the time of writing. The team has also not released a full post-mortem explaining how many accounts were affected or whether all attacker activity has stopped.</p>
<h2 class="wp-block-heading" id="strong-wider-payment-security-context-strong"><strong>Wider payment security context</strong></h2>
<p>As previously <a href="https://crypto.news/payy-raises-6m-seed-to-build-private-stablecoin-payments-on-zero-knowledge-rails/" rel="noopener noreferrer nofollow">reported</a> by crypto.news, Gnosis Pay launched a self-custody card for crypto spending at Visa merchants. The product was built to connect blockchain wallets with real-world payments.</p>
<p>That design places Gnosis Pay in a growing group of crypto payment tools that use smart contracts to support everyday spending. It also puts more attention on the code that controls wallet permissions and transaction timing.</p>
<p>The latest warning does not describe Gnosis Pay as shut down. It says users should withdraw EURe and GNO while the team works to contain the <a href="https://crypto.news/stake-dao-exploit-update-key-products-unaffected-bridge-closed/" rel="noopener noreferrer nofollow">exploit</a>.</p>
<p>Read more: <a href="https://crypto.news/will-bitcoin-lose-72k-support-as-it-enters-a-bearish-channel-amid-etf-outflows/" rel="noopener noreferrer nofollow"> Will Bitcoin lose $72K support as it enters a bearish channel amid ETF outflows? </a></p>

Gnosis Pay exploit tied to Zodiac delay module as users exit

Table of Contents

crypto.news

Other articles published on Jun 1, 2026

Join our free newsletter for daily crypto updates!