Safe

Security

Gnosis

Zodiac

<h2 id="key-takeaways">Key Takeaways</h2><ul><li>Gnosis announces complete reimbursement for all victims of Gnosis Pay security incident</li><li>Critical vulnerability in Zodiac Delay Module enables unauthorized transaction execution</li><li>Emergency containment measures deployed across compromised Safe wallet infrastructure</li><li>EURe and GNO token holders urged to withdraw funds immediately</li><li>Security incident highlights ongoing vulnerabilities in blockchain payment solutions</li></ul><p>A critical security vulnerability forced <a href="https://coincentral.com/tether-and-gnosis-lead-4-4m-seed-round-for-mobile-first-crypto-wallet/" rel="noopener noreferrer nofollow">Gnosis</a> into emergency response mode after malicious actors exploited a weakness in the Zodiac Delay Module. The attack compromised Safe-based payment infrastructure and prompted immediate containment protocols. The company has committed to providing complete restitution to all affected users.</p><h2 id="critical-vulnerability-discovered-in-zodiac-delay-module">Critical Vulnerability Discovered in Zodiac Delay Module</h2><p>The security compromise originated from a previously unknown vulnerability within the Zodiac Delay Module integrated into <a href="https://coincentral.com/gnosis-executes-hard-fork-to-secure-funds-lost-in-november-balancer-hack/" rel="noopener noreferrer nofollow">Gnosis</a> Pay infrastructure. This component typically enforces time-based restrictions on outbound transactions to enhance security. However, attackers discovered a method to circumvent these protections and execute unauthorized transfers from vulnerable Safe wallets.</p><p>The Gnosis Pay platform bridges cryptocurrency holdings with traditional payment networks by utilizing Safe smart contract wallets. These accounts connect digital assets to physical payment cards for everyday transactions. The modular architecture that enables this functionality inadvertently created an attack vector when one component contained exploitable code.</p><p>Martin Köppelmann, co-founder of <a href="https://coincentral.com/gnosis-stefan-george-on-barriers-to-adoption-for-decentralized-exchanges/" rel="noopener noreferrer nofollow">Gnosis</a>, publicly acknowledged the delay module vulnerability. He confirmed that attackers gained the ability to trigger transactions from compromised Safe accounts. The development team immediately classified the situation as a critical security emergency requiring immediate user action.</p><h2 id="emergency-response-protocols-activated">Emergency Response Protocols Activated</h2><p>Gnosis implemented multiple defensive strategies to minimize ongoing damage as the exploitation continued. The organization contacted bridge validators with requests to temporarily suspend operations, effectively limiting potential exit channels for stolen assets. This infrastructure-level intervention aimed to restrict attacker mobility while security teams analyzed the breach.</p><p>Users received urgent notifications to immediately withdraw EURe stablecoins and GNO tokens from potentially vulnerable accounts. Köppelmann acknowledged that manual withdrawal might not be feasible for all users. The response strategy therefore prioritized system-wide protective measures to safeguard remaining funds.</p><p>Blockchain security provider PeckShield independently confirmed the active exploitation targeting Gnosis Pay users. The firm issued public warnings encouraging account holders to verify their exposure status and move assets to secure locations. Throughout the incident, Gnosis maintained its commitment to absorb all financial losses experienced by users.</p><h2 id="reimbursement-promise-highlights-smart-contract-payment-challenges">Reimbursement Promise Highlights Smart Contract Payment Challenges</h2><p>Gnosis has not yet disclosed the total financial impact of the security breach. A comprehensive technical post-mortem analyzing the exploit methodology remains unpublished. The exact number of compromised accounts has not been confirmed in official communications.</p><p>This incident intensifies scrutiny of blockchain-based payment infrastructure security. Gnosis Pay represents an innovative approach to cryptocurrency spending, connecting non-custodial wallets directly to Visa’s payment network for mainstream commerce. While this design preserves user sovereignty over funds, it simultaneously creates dependencies on secure permission management.</p><p>The vulnerability adds to a concerning pattern of attacks targeting Safe wallet ecosystems. Blockaid previously documented a separate incident resulting in $3 million in losses across 86 Safe wallets deployed on Ethereum and Base networks. These repeated compromises demonstrate how third-party modular components can introduce significant security risks into cryptocurrency payment platforms and wallet systems.</p><p>The post <a href="https://blockonomi.com/gnosis-pay-exploit-full-user-reimbursement-promised-following-security-incident/" rel="noopener noreferrer nofollow">Gnosis Pay Exploit: Full User Reimbursement Promised Following Security Incident</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.</p>

Gnosis Pay Exploit: Full User Reimbursement Promised Following Security Incident

Table of Contents

Blockonomi

Other articles published on Jun 1, 2026

Bithumb Adjusts SLX Listing Schedule, Delays KRW Trading by One Hour

SuperEx Educational Series: Understanding Zero-Knowledge Circuit Design

RLUSD Explained: Ripple's Dollar Stablecoin and Its Role in the XRP Ecosystem

How Do You Get Listed on Aster? Listings Go Permissionless

Cardano's EUTXO Model Explained & How It Differs From Ethereum's Account Model

Securing Billions: What is Chainlink's CCIP?

Join our free newsletter for daily crypto updates!