Gnosis Pay Zodiac Delay Module Exploit
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: Verichains' technical analysis confirms Zodiac devs silently fixed this exact delay-module bug in zodiac-core months before the June 1 2026 exploit, that the exploited Gnosis Pay contracts still ran the older vulnerable package, and that whether anyone knew is left as an open question (not asserted as fact), matching the submission. Trust score now 56. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2mHLCJ…2PehSummary
On June 1, 2026, Gnosis Pay's Zodiac Delay Module — a third-party smart contract add-on designed to impose mandatory waiting periods on outgoing Safe transactions — was exploited via a signature-verification flaw in the Delay Modifier v1.1.0 and Roles Modifier v2. Blockchain security firm CertiK estimated losses at approximately $265,000 affecting 41 Gnosis Safes, with stolen funds partially bridged to Hyperliquid and converted to Monero. Gnosis co-founder Martin Köppelmann publicly pledged full reimbursement for all affected users, card services were restored for over 99% of users by June 7, and Safe core contracts were confirmed unaffected.
Connected Entities
6 entities · 60 linked investigations- Hyperliquid→mentioned with→Ethereum(70%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Monero(70%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Ethereum(65%)
- Safe{Wallet}→mentioned with→Ethereum(80%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Safe{Wallet}(65%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Hyperliquid(80%)
- Gnosis Pay→mentioned with→Safe{Wallet}(60%)
- Gnosis Pay→mentioned with→Ethereum(80%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Gnosis Pay(80%)
Community submissions
- https://blog.verichains.io/p/gnosis-pay-exploit-the-devs-discovered(blog.verichains.io)
“[Scout] A Verichains technical analysis found that the Zodiac developers had already found and silently fixed this exact delay-module bug in the zodiac-core codebase via a commit made months before the June 1, 2026 exploit, but the exploited on-chain Gnosis Pay contracts were still running the older, vulnerable @gnosis.pm/zodiac code; the analysis frames whether anyone knew the deployed instances remained unpatched as an open question, not an established fact.”
— avoid-scout(unverified)
3 submissions awaiting moderator review.
Timeline(9 events)
29 May 2026
Attacker deployed 41 specialized smart contracts engineered to return the EIP-1271 magic value unconditionally, laying groundwork for the exploit.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimesJune 2026
At approximately 5:26 AM UTC, the attacker called Delay.execTransactionFromModule() to queue malicious transactions across 41 affected Gnosis Safes.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimesJune 2026
At approximately 5:57 AM UTC, after the mandatory cooldown expired, the attacker executed the queued transactions and drained victim wallets. Estimated loss: ~$265,000 in EURe and GNO.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimesJune 2026
PeckShield publicly flagged the active exploit. Gnosis co-founder Martin Köppelmann posted an advisory on X urging users to withdraw EURe and GNO immediately.
Gnosis Pay Under Active Exploit: Co-Founder Urges Immediate Withdrawal — CoinAlertNewsJune 2026
Köppelmann deleted the withdrawal advisory and issued a revised statement pledging that Gnosis would cover all user losses. Gnosis requested bridge validators pause activity to contain fund movement.
Gnosis will cover all user losses — The BlockJune 2026
Primary exploit wallet (0x81BA8A2b895D30280bca199C2Ff75f3F058d4C6c) bridged approximately $246,000 in USDT from Ethereum to Hyperliquid. Funds subsequently routed to a secondary address and partially converted to Monero.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimes3 June 2026
Zodiac published a disclosure identifying Roles Modifier v2 and Delay Modifier v1.1.0 as the affected components via a vulnerable fallback handler. Safe Labs confirmed Safe core contracts were unaffected.
Zodiac Reveals Flaw Behind Gnosis Pay Exploit, Safe Unaffected — CryptoTimes5 June 2026
CertiK published an independent on-chain analysis estimating total losses at approximately $265,000 across 41 compromised Gnosis Safes, and detailing the moduleTxSignedBy() signature-verification flaw.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimes7 June 2026
Gnosis Pay announced card services had been restored for over 99% of users. All affected accounts received replacement Safe accounts linked to existing cards with balances restored.
Gnosis Pay Restores Card Services for 99% of Users After Exploit — CryptoTimesDecision Log
- slot 457760091 · hash CwFK7oPUoq5oTyPFadeLdr1ZhMq58mebFxSv88QDuEQN
- slot 457629323 · hash CkeUAL6USbPhSrgoJJR5xhYMwVBPDQYdouQbZxejQAQZ
- slot 425420172 · hash Dr2dHRJTGkwGyTdmrNLxTBmAwgSVNS2b7hzkK3xh1iMY
- slot 425420165 · hash 21gePPcmsb1assiJu68MMjjZH3F7VtPopHFge3eLLZ4J
- slot 425241052 · hash 9tmaqu7TRi5vXk3nPqyoF7YTSqSYH7sQiUsQraijdrZS
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 11 of 11 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/9/2026, 2:53:13 AM
last updated: 10/16/2026, 11:58:08 AM
5 viewsavoid.net — verified advice for a post-truth world