SquidRouterModule (Third-Party Gnosis Safe Module) — Constant-String Auth Bypass, 86 Safes Drained

Timeline: On 25 May 2026, a malicious third-party Gnosis Safe module verified on Basescan as 'SquidRouterModule' (no relation to the official Squid Router protocol) was used to drain about $3.2M from 86 Gnosis Safe wallets across Ethereum and Base in roughly two hours. Per Squid's own statement, the module accepted a caller-supplied constant string -- publicly readable in the verified contract's code -- as proof that a message was secure; supplying that string allowed execution of an arbitrary array of calldata. Any Safe that had added the module as a trusted Safe Module had effectively granted it unconditional execution power. The attacker (0x9bdc7301...645b91), funded with 2.1 ETH from Tornado Cash about 14 hours earlier, forced fake Uniswap V3 swaps from real tokens into a worthless 'u' token in attacker-controlled pools, then consolidated proceeds into ~3.07M DAI. An example drain transaction confirmed at 06:25:23 UTC on 25 May. Blockaid raised the public alert around 08:39 UTC, PeckShield corroborated shortly after, and Squid clarified within hours that the module was a third-party contract unrelated to its core router (0xce16F6...8D666, unaffected). A Common Prefix post-mortem reportedly cited a higher figure of $3.98M across 88 Safes; that figure could not be corroborated against accessible tier-1 sources, so the convergent $3.2M / 86 Safes figure (Blockaid, Squid, The Block, PeckShield) is used here. Affected users were advised to revoke the module from their Safes. Recovery: 0%.