Security firms PeckShield and Blockaid said about $3.2 million was siphoned from 86 Gnosis Safe wallets in less than two hours on May 25, 2026, across Ethereum and Base. According to PeckShield, the attacker wallet 0xA447…54859, initially funded with 2.1 ETH from TornadoCash, converted the stolen assets into roughly $3 million in DAI through attacker-controlled Uniswap V3 pools. Blockaid said the victims had previously authorized the third-party SquidRouterModule as a trusted Safe Module with elevated privileges, allowing withdrawals without fresh user signatures. Updated reporting added that the module allegedly relied on a caller-supplied immutable string as a security check, which attackers could read from public source code and use to bypass protections. Squid stated the exploited contract was not built, deployed, or managed by Squid, and said its core protocol and official router contract were unaffected.