Blockaid Reports Ongoing Attack on Squid Protocol: $3 Million Drained from 86 Gnosis Safe Wallets

On-chain security firm Blockaid has identified an active attack targeting the SquidRouterModule of the cross-chain protocol Squid. The incident, which has been unfolding over the past two hours, has resulted in the theft of approximately $3 million in digital assets from 86 Gnosis Safe wallets across the Ethereum and Base networks.

Attack Details and Immediate Impact

According to Blockaid’s preliminary analysis, the attacker exploited a vulnerability in the SquidRouterModule, a component responsible for facilitating cross-chain swaps. The compromised funds were reportedly swapped for DAI through a Uniswap V3 pool controlled by the attacker. The attack has affected a significant number of Gnosis Safe multisignature wallets, raising concerns about the security of modular smart contract implementations.

Blockaid stated that an investigation is currently underway to determine the root cause of the exploit and to identify the attacker. The firm has not yet disclosed whether the vulnerability was related to a code bug, a compromised key, or a more sophisticated attack vector. The incident highlights the ongoing risks associated with cross-chain infrastructure, which remains a frequent target for malicious actors due to its complexity and the large value of assets often bridged between networks.

Broader Context and Implications

Cross-chain protocols like Squid enable users to swap assets between different blockchains without relying on centralized exchanges. While this technology improves interoperability, it also introduces unique security challenges. The Squid protocol, built on top of the Axelar network, is designed to facilitate seamless token transfers across multiple chains. This attack marks the latest in a series of high-profile exploits targeting cross-chain bridges and messaging protocols.

The incident comes at a time when the decentralized finance (DeFi) ecosystem is under increased scrutiny from regulators and security researchers. Losses from cross-chain bridge hacks have totaled hundreds of millions of dollars in recent years, with attackers often exploiting smart contract vulnerabilities or using sophisticated social engineering tactics. The use of Gnosis Safe wallets—a popular choice for DAOs and institutional investors—adds another layer of concern, as these wallets are typically considered more secure than standard externally owned accounts.

What This Means for Users

For users of the Squid protocol and related cross-chain services, this attack serves as a reminder of the importance of due diligence. While the exploit appears to be limited to the SquidRouterModule, users should monitor their wallets for any unauthorized transactions. It is also advisable to revoke any unnecessary token approvals associated with the protocol until the investigation is complete and the vulnerability is patched.

The broader DeFi community will be watching closely as Blockaid and the Squid team work to contain the damage and prevent further losses. The incident may also prompt renewed calls for more rigorous auditing and formal verification of cross-chain smart contracts.

Conclusion

The ongoing attack on the Squid protocol, which has drained approximately $3 million from 86 Gnosis Safe wallets, underscores the persistent security challenges facing cross-chain infrastructure. As investigations continue, the incident serves as a critical case study for developers and users alike, highlighting the need for robust security measures and proactive monitoring in the rapidly evolving DeFi landscape.

FAQs

Q1: What is the Squid protocol?
The Squid protocol is a cross-chain swap platform that allows users to exchange assets between different blockchains, leveraging the Axelar network for interoperability.

Q2: How much was stolen in the attack?
Approximately $3 million in digital assets was drained from 86 Gnosis Safe wallets on Ethereum and Base.

Q3: What should Squid users do now?
Users should monitor their wallets for suspicious activity and revoke any token approvals related to the Squid protocol until the vulnerability is fully resolved.