Gnosis Pay Zodiac Delay Module Exploit
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2mHLCJ…2PehSummary
On June 1, 2026, Gnosis Pay's Zodiac Delay Module — a third-party smart contract add-on designed to impose mandatory waiting periods on outgoing Safe transactions — was exploited via a signature-verification flaw in the Delay Modifier v1.1.0 and Roles Modifier v2. Blockchain security firm CertiK estimated losses at approximately $265,000 affecting 41 Gnosis Safes, with stolen funds partially bridged to Hyperliquid and converted to Monero. Gnosis co-founder Martin Köppelmann publicly pledged full reimbursement for all affected users, card services were restored for over 99% of users by June 7, and Safe core contracts were confirmed unaffected.
Connected Entities
6 entities · 60 linked investigations- Hyperliquid→mentioned with→Ethereum(70%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Monero(70%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Ethereum(65%)
- Safe{Wallet}→mentioned with→Ethereum(80%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Safe{Wallet}(65%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Hyperliquid(80%)
- Gnosis Pay→mentioned with→Safe{Wallet}(60%)
- Gnosis Pay→mentioned with→Ethereum(80%)
- Gnosis Pay Zodiac Delay Module Exploit→mentioned with→Gnosis Pay(80%)
3 submissions awaiting moderator review.
Timeline(9 events)
29 May 2026
Attacker deployed 41 specialized smart contracts engineered to return the EIP-1271 magic value unconditionally, laying groundwork for the exploit.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimesJune 2026
At approximately 5:26 AM UTC, the attacker called Delay.execTransactionFromModule() to queue malicious transactions across 41 affected Gnosis Safes.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimesJune 2026
At approximately 5:57 AM UTC, after the mandatory cooldown expired, the attacker executed the queued transactions and drained victim wallets. Estimated loss: ~$265,000 in EURe and GNO.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimesJune 2026
PeckShield publicly flagged the active exploit. Gnosis co-founder Martin Köppelmann posted an advisory on X urging users to withdraw EURe and GNO immediately.
Gnosis Pay Under Active Exploit: Co-Founder Urges Immediate Withdrawal — CoinAlertNewsJune 2026
Köppelmann deleted the withdrawal advisory and issued a revised statement pledging that Gnosis would cover all user losses. Gnosis requested bridge validators pause activity to contain fund movement.
Gnosis will cover all user losses — The BlockJune 2026
Primary exploit wallet (0x81BA8A2b895D30280bca199C2Ff75f3F058d4C6c) bridged approximately $246,000 in USDT from Ethereum to Hyperliquid. Funds subsequently routed to a secondary address and partially converted to Monero.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimes3 June 2026
Zodiac published a disclosure identifying Roles Modifier v2 and Delay Modifier v1.1.0 as the affected components via a vulnerable fallback handler. Safe Labs confirmed Safe core contracts were unaffected.
Zodiac Reveals Flaw Behind Gnosis Pay Exploit, Safe Unaffected — CryptoTimes5 June 2026
CertiK published an independent on-chain analysis estimating total losses at approximately $265,000 across 41 compromised Gnosis Safes, and detailing the moduleTxSignedBy() signature-verification flaw.
Delay Module Trick Costs GnosisPay $265K, Reports CertiK — CryptoTimes7 June 2026
Gnosis Pay announced card services had been restored for over 99% of users. All affected accounts received replacement Safe accounts linked to existing cards with balances restored.
Gnosis Pay Restores Card Services for 99% of Users After Exploit — CryptoTimesDecision Log
- slot 425420172 · hash Dr2dHRJTGkwGyTdmrNLxTBmAwgSVNS2b7hzkK3xh1iMY
- slot 425420165 · hash 21gePPcmsb1assiJu68MMjjZH3F7VtPopHFge3eLLZ4J
- slot 425241052 · hash 9tmaqu7TRi5vXk3nPqyoF7YTSqSYH7sQiUsQraijdrZS
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 11 of 11 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/9/2026, 2:53:13 AM
last updated: 6/9/2026, 2:53:13 AM
5 viewsavoid.net — verified advice for a post-truth world