Gnosis Pay had a feature that delayed every transaction so users could cancel hacks in real time. Today someone used that feature to hack everyone using it. Every Gnosis Pay wallet runs a Zodiac Delay Module. It queues outgoing transactions and forces a wait before they execute. The whole point is to give users a window to cancel anything they didn't approve. Someone figured out how to initiate transactions through that exact module. The core Safe contracts are fine. The wallet itself is fine. The thing wrapped around the wallet to protect it is what's getting drained. The Gnosis team's first move was to tell users to withdraw. They deleted that tweet minutes later. The same exploit applied to user withdrawals. Most people can't get their funds out even if they want to. This is the second Safe module exploit in eight days. The first drained $3 MILLION from 86 wallets through a different module. Same pattern. Different attacker. Safe's core contracts have been audited dozens of times. They've never been the problem. The modules built on top of them are not part of those audits. Every exploit this year keeps happening in the same layer. The contracts hold. The extra layers built to make them safer don't.