Third-Party Smart Wallet Bug Leads to $3.2 Million Crypto Theft

[madmax]

A vulnerability in a third-party Gnosis Safe module resulted in approximately $3.2 million being stolen from dozens of wallets across Ethereum and Base. Blockchain security firms reported that attackers exploited a trusted module configuration to gain unauthorized access and transfer user funds.

Investigators revealed that the compromised module accepted a publicly available string as proof of message validity, allowing attackers to execute malicious transactions without obtaining wallet owner signatures. The stolen assets were later converted into DAI through attacker-controlled liquidity pools, making recovery efforts more difficult.

The exploit adds to a growing list of security incidents affecting the crypto industry in 2026. While audits remain a critical part of protocol security, recent attacks continue to show that operational configurations, third-party modules, and trusted integrations often present risks that are just as significant as vulnerabilities in smart contract code.

[etfs]

attackers discovering they did not need private keys when someone accidentally accepted a public string as proof of authorization