BlockBeats report: On May 25, the cross-chain protocol Squid responded to the security incident, stating that the attack did not occur on Squid’s core protocol or Router contract, but rather due to a critical vulnerability in a third-party Gnosis Safe module named "SquidRouterModule," resulting in the theft of approximately $3.2 million in assets on Base and Ethereum.
Squid stated that this module was not developed, deployed, or operated by the official team; it was merely integrated by a third-party smart wallet product. Attackers can bypass validation by passing a public string and execute arbitrary calls to steal funds. The affected wallets had previously marked this module as a trusted Safe Module, allowing asset transfers without requiring a signature.
Squid emphasized that its official Router contract, user funds, authorizations, and integrations have not been affected and no additional actions are required.