What’s important here is that this was NOT a direct exploit of Squid’s core protocol.

Instead, the attackers targeted a vulnerable smart wallet module that had broad spending permissions inside users’ Safes. Once approved as a trusted module, the contract could move tokens without requiring additional signatures.

The flaw?
The module accepted a caller-supplied constant string as “proof” that a transaction was secure — and that string was publicly visible in the contract code itself.

That effectively allowed attackers to:
• Inject arbitrary calldata
• Execute unauthorized transfers
• Drain wallet assets instantly

Blockchain security firm PeckShield says the attacker’s wallet was initially funded using Tornado Cash, while Blockaid tracked stolen assets being converted into DAI through attacker-controlled liquidity pools.

May 2026 alone has already seen over 20 crypto exploits according to DefiLlama, showing how smart contract integrations and wallet permissions continue to be one of DeFi’s biggest security risks.