Blockchain security firm Blockaid has uncovered an ongoing exploit targeting the SquidRouterModule on Ethereum and Base networks, with 86 Gnosis Safes compromised for approximately $3 million in under two hours. The stolen assets were converted to DAI using attacker-controlled Uniswap V3 pools, according to Blockaid’s analysis.
The security firm’s alert identified the exploiter address as 0x9bdc730183821b6bb2b51be30b77c964fa645b91, which was funded through Tornado Cash and showed 52 transactions on May 25. A consolidation wallet was also flagged, holding about 3.07 million DAI (roughly $3.07 million) along with a small ETH balance, as confirmed by Etherscan data.
One example transaction shared by Blockaid occurred at 06:25:23 UTC on May 25, interacting with another address linked to the exploit flow. The transaction involved swaps of USDC, ENA, and USDT through Uniswap V3 pools, supporting claims that stolen funds were routed via decentralized exchange liquidity.
This incident adds to a series of DeFi exploits in May, keeping security teams on high alert. Previously, StablR’s EURR and USDR stablecoins suffered a depeg after a suspected private key compromise led to the loss of about $2.8 million, with Blockaid tracing the attack to a compromised multisig owner. Another May exploit involved ShapeShift’s FOX Colony on Arbitrum, where a smart contract vulnerability initially drained $132,700 before related losses reached $182,700.
The trend of attackers targeting private keys, signing systems, bridges, and wallets—rather than solely smart contract code—persists. A DefiLlama report noted 518 hacks over a decade, with total losses exceeding $17 billion. The SquidRouterModule exploit underscores the risk in connected DeFi infrastructure, particularly module permissions and Safe integrations that require thorough review.