Crisis Averted: Ripple-Backed Squid Router Not Drained for $3 Million!
Cross-chain platform Squid Router was mistakenly linked to a $3.2 million hack due to a critical vulnerability in a third-party module named "SquidRouterModule." The legitimate Squid Router protocol and its users remained unaffected, as the exploit targeted an independent integration without the core developers' knowledge. This clarification debunks initial social media rumors and confirms the safety of Squid's core operations.
The cross-chain platform Squid Router, which recently secured $6 million in funding from Ripple, found itself embroiled in a misunderstanding following a hacker attack on third-party software that bore a similar name.
Initial reports circulating on social media erroneously claimed that $3 million had been stolen directly from the Squid protocol.
However, subsequent on-chain analysis and official statements from the development team quickly debunked these rumors, clarifying the true nature of the incident.
Investigations by security firms Blockaid and PeckShield revealed that the exploit originated from a critical vulnerability within the code of a third-party module identified as "SquidRouterModule."
The attacker leveraged this flaw to bypass standard security checks by using a publicly available text string, effectively impersonating a trusted delegate.
Crucially, the affected users had previously added this specific defective contract to their digital wallets, granting the hacker the unauthorized right to spend their assets without requiring personal signatures.
The hacker's method involved a sophisticated process: utilizing Uniswap V3, they forcibly swapped the victims' legitimate tokens for counterfeit ones.
Following this, the attacker extracted liquidity from the pools and then withdrew the ill-gotten funds to a wallet address specified as "0xA447...54859".
This coordinated attack allowed the hacker to drain 86 Gnosis Safe addresses across both the Ethereum and Base networks within a mere two-hour window, resulting in the theft of 3.07 millionDAI, or approximately $3.2 million as confirmed by a tweet from the official Squid account.
The confusion and media panic stemmed solely from the shared "Squid" name in the vulnerable contract.
The legitimate Squid Router team, led by co-founder "fig," swiftly clarified that the "SquidRouterModule" contract in question belonged to an independent, unknown third-party smart wallet.
This entity had integrated Squid's functionality without the core developers' knowledge or oversight.
The platform's authentic contract, identified as "0xce16F69375520ab01377ce7B88f5BA8C48F8D666," possesses a distinct architectural design and remained completely unaffected by the exploit.
The team reassured its community that user funds and approvals across all 100+ supported networks were fully secure, emphasizing that the incident was unrelated to Squid’s core protocol or its contracts, and no action was required from its users or integrators.
This attempt to tarnish Squid's reputation coincided with a period of significant positive media attention for the project.
Just days prior, on May 22,the platform had proudly announced a strategic $6 million funding round from prominent investors including Ripple, North Island Ventures, and angel investors from Axelar and Ledger.
These funds are earmarked for further expanding Squid's ecosystem, which has already achieved impressive milestones, processing over $6 billion in volume for more than one millionusers since its inception in 2023.
Ultimately, the incident has been confirmed to have no impact whatsoever on the operations, infrastructure, or development plans of the legitimate Squid Router DeFi protocol.