Oh, Not Again! $3 Million Vanishes in SquidRouterModule Debacle!

Blockaid, the digital equivalent of a nosy neighbor with a telescope and a clipboard, has once again spotted chaos unfolding in the blockchain neighborhood. This time, 86 Gnosis Safes were pillaged of roughly $3 million in a mere two hours. Because of course they were. It’s May.

  • 86 Gnosis Safes drained like a particularly unfortunate game of “hot potato” with $3 million.
  • Stolen assets? Swiftly transformed into DAI via Uniswap V3 pools the attacker probably named “Bob’s Discount Laundering Emporium.”
  • May 2026: The month where DeFi decided to reenact the Wild West, but with more emojis and fewer horses.

The security gurus at Blockaid noted that the ill-gotten gains were converted into DAI with all the subtlety of a bull in a china shop, but the china shop here is a decentralized exchange and the bull is a wallet address with a grudge. The alert helpfully included an exploiter address, a consolidation wallet (because criminals need budgeting too), and a sample transaction for your forensic enjoyment.

According to Blockaid’s X thread-imagine Twitter if everyone there was just yelling about wallet breaches-the exploit targeted Gnosis Safes linked to the SquidRouterModule. The attack moved faster than a caffeinated squirrel on a deadline, draining Safes before the stolen assets could even say “hold my decentralization.”

🚨 Blockaid detects yet another exploit, because blockchain security is basically Whack-a-Mole with six-digit bounties.

86 Gnosis Safes emptied like a budget supermarket on payday.
All stolen tokens? Now DAI. Because nothing says “I’ve won” like turning chaos into a stablecoin.
More in this thread, if you like your weekends filled with existential dread.

– Blockaid (@blockaid_) May 25, 2026

The exploiter address, 0x9bdc730183821b6bb2b51be30b77c964fa645b91, was funded by Tornado Cash, which is like the blockchain equivalent of a shady laundromat that smells of regret and diesel. Etherscan reveals 52 transactions, all suspiciously timed around the phrase “I swear this is legal.”

Blockaid also highlighted a consolidation wallet holding 3.07 million DAI (which, shockingly, is still worth $3.07 million because stablecoins are nothing if not stubborn) and a dash of ETH for flavor. It’s the financial equivalent of a “mixtape of despair.”

Stolen Tokens Take a Spin on Uniswap V3’s Carnival Ride

The sample transaction, executed at 06:25:23 UTC on May 25, was like watching a magician turn rabbits into hats-but the rabbits are USDC, ENA, and USDT, and the hat is a pile of DAI. The transaction interacted with other addresses in a dance so coordinated, it could’ve been choreographed by a very stressed ballet instructor.

May: The Month Security Teams Realize They Need Therapy

Just days earlier, StablR’s EURR and USDR stablecoins lost their pegs after someone decided “minting permissions” were more of a guideline. Blockaid traced it to a compromised multisig owner, which is like leaving your house key under the doormat in a neighborhood full of locksmiths. The attacker minted 12.85 million tokens and converted them into 1,115 ETH, which is roughly enough to buy a small island or a very fancy yacht.

Earlier in May, ShapeShift’s FOX Colony on Arbitrum lost $132,700, then a related exploit added another $50k to the tab. Because why stop at one heist when you can have a trilogy?

DeFi: Where Every Day is “Bring Your Own Vulnerability” Day

DefiLlama has logged 518 hacks over a decade, totaling over $17 billion. That’s enough to buy every person on Earth a cup of coffee and still have enough left for a lifetime supply of NFTs of coffee cups.

Private keys, signing systems, bridges, and wallets are now the “it” targets for hackers, making Safe integrations about as reassuring as a chocolate teapot. TrustedVolumes lost $6.7 million in an exploit tied to a custom RFQ swap proxy, because who doesn’t want their resolver drained like a swamp in a drought?

The SquidRouterModule exploit? Just another day in DeFi, where the infrastructure isn’t a safety net-it’s a trampoline leading straight into a pit of alligators wearing top hats and monocles.

Read More

2026-05-25 15:57