← Gnosis Pay Zodiac Delay Module Exploitreviewed 2026-10-16 · 22 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Gnosis Pay Zodiac Delay Module Exploit against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
5 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #18[disputed][awaiting moderator]in the timeline
“2026-06”
reviewerTimeline date: attacker calling Delay.execTransactionFromModule() at ~5:26 AM UTC occurred on June 1, 2026.The stored date field has been truncated to month-only precision even though the entry's own date_original ('2026-06-01') and every corroborating source place it on an exact day. This understates precision that is actually known.Proposed correction (not yet applied)2026-06-01 - #19[disputed][awaiting moderator]in the timeline
“2026-06”
reviewerTimeline date: the attacker executed queued transactions and drained wallets at ~5:57 AM UTC on June 1, 2026.Same defect as timeline[1]: month-only date field when the exact date is known and recorded in date_original.Proposed correction (not yet applied)2026-06-01 - #20[disputed][awaiting moderator]in the timeline
“2026-06”
reviewerTimeline date: PeckShield flagged the exploit and Köppelmann posted the withdrawal advisory on June 1, 2026.Same month-only truncation defect.Proposed correction (not yet applied)2026-06-01 - #21[disputed][awaiting moderator]in the timeline
“2026-06”
reviewerTimeline date: Köppelmann deleted the advisory and Gnosis requested a bridge pause on June 1, 2026.Same month-only truncation defect.Proposed correction (not yet applied)2026-06-01 - #22[disputed][awaiting moderator]in the timeline
“2026-06”
reviewerTimeline date: the exploit wallet bridged funds to Hyperliquid and converted a portion to Monero on June 1, 2026.Same month-only truncation defect; this is the fifth and last occurrence of this defect_group.Proposed correction (not yet applied)2026-06-01
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #6[partially supported][awaiting moderator]in section: Technical Vulnerability
“CertiK's post-incident analysis identified the root cause as a signature-verification flaw in the Delay module's moduleTxSignedBy() function, specifically in how it parsed r, s, and v values from msg.data calldata.”
reviewerCertiK identified the root cause as a signature-verification flaw in moduleTxSignedBy(), specifically in r, s, v parsing from msg.data calldata.The CertiK-sourced description is correct but incomplete. The accepted Verichains submission adds a materially different framing — the bug was known and silently patched elsewhere months earlier — that changes the incident from 'undiscovered flaw' to 'unported fix,' and should be reflected in the technical section. - #10[partially supported][awaiting moderator]in section: Financial Impact and On-Chain Activity
“Exploit hits Gnosis Pay, TesseraDAO loses $2.5M as June hacks start to climb — Cryptopolitan”
reviewerCryptopolitan's TesseraDAO article corroborates the Gnosis Pay financial-impact figures in this section.This citation is topically adjacent but does not actually support the financial figures in the section; the $265,000/41-Safe claim is independently well supported by the CryptoTimes/CertiK source, but Cryptopolitan should not be listed as evidence for it.
confirmed
15 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“On June 1, 2026, Gnosis Pay's Zodiac Delay Module — a third-party smart contract add-on designed to impose mandatory waiting periods on outgoing Safe transactions — was exploited via a signature-verification flaw in the Delay Modifier v1.1.0 and Roles Modifier v2.”
reviewerOn June 1, 2026, the Zodiac Delay Module was exploited via a signature-verification flaw in Delay Modifier v1.1.0 and Roles Modifier v2.Independently corroborated by a second, unrelated outlet (Crowdfund Insider) reporting on the same CertiK findings. - #2[confirmed][no action needed]in the summary
“Blockchain security firm CertiK estimated losses at approximately $265,000 affecting 41 Gnosis Safes, with stolen funds partially bridged to Hyperliquid and converted to Monero.”
reviewerCertiK estimated losses at approximately $265,000 affecting 41 Gnosis Safes.No official Gnosis figure exists; both independent secondary reports trace to the same CertiK analysis but agree on the number. - #3[confirmed][no action needed]in the summary
“Gnosis co-founder Martin Köppelmann publicly pledged full reimbursement for all affected users, card services were restored for over 99% of users by June 7, and Safe core contracts were confirmed unaffected.”
reviewerMartin Köppelmann publicly pledged full reimbursement for all affected users.Accurately framed as a pledge; the page does not overstate it as a completed, verified reimbursement. - #4[confirmed][no action needed]in section: Incident Overview
“The exploit was first flagged publicly by blockchain security firm PeckShield, with Gnosis co-founder Martin Köppelmann confirming the incident on X (formerly Twitter) and urging users to withdraw EURe and GNO funds.”
reviewerThe exploit was first flagged publicly by blockchain security firm PeckShield.The page's directly cited source supports the PeckShield-first sequence, though other secondary coverage of the same day is less precise about ordering. Not disputed given the primary citation holds. - #5[confirmed][no action needed]in section: Incident Overview
“Köppelmann subsequently deleted the withdrawal advisory, acknowledging that most users would be unable to execute manual withdrawals in time. Gnosis asked bridge validators to pause related bridge activity to limit cross-chain movement of potentially stolen funds.”
reviewerKöppelmann deleted the withdrawal advisory, acknowledging most users could not withdraw in time; Gnosis asked bridge validators to pause bridge activity.Directly corroborated by both cited sources. - #7[confirmed][no action needed]in section: Technical Vulnerability
“Beginning May 29, 2026 — two days before the exploit — the attacker deployed 41 specialized attack contracts engineered to always return the EIP-1271 magic value when called via isValidSignature(), effectively impersonating legitimate signers without providing valid cryptographic proof.”
reviewerBeginning May 29, 2026, the attacker deployed 41 specialized attack contracts; on June 1 at ~5:26 AM UTC queued transactions, and at ~5:57 AM UTC executed them after the cooldown.Confirmed by two independent outlets both summarizing CertiK's analysis. - #8[confirmed][no action needed]in section: Technical Vulnerability
“The Zodiac team and Safe Labs both confirmed that Safe core smart contracts, Safe{Wallet} infrastructure, account recovery systems, and the Safe user interface were not affected.”
reviewerSafe core smart contracts, Safe{Wallet} infrastructure, account recovery systems and the Safe UI were not affected.Directly confirmed. - #9[confirmed][no action needed]in section: Financial Impact and On-Chain Activity
“The primary exploit wallet (0x81BA8A2b895D30280bca199C2Ff75f3F058d4C6c) bridged approximately $246,000 in USDT from Ethereum to the Hyperliquid network.”
reviewerCertiK estimated total losses at ~$265,000 in EURe/GNO affecting 41 Gnosis Safe accounts; exploit wallet bridged ~$246,000 USDT to Hyperliquid; funds routed to a secondary address and partly converted to Monero.No independent on-chain explorer (Etherscan/Arkham) cross-check was performed by the page or by this review; see coverage_gaps. - #11[confirmed][no action needed]in section: Financial Impact and On-Chain Activity
“As of the time of reporting, Gnosis had not officially confirmed the total loss figure, and no comprehensive on-chain breakdown from Gnosis itself had been published.”
reviewerGnosis had not officially confirmed the total loss figure as of the time of reporting; the $265,000 figure is CertiK's estimate pending official disclosure.Confirmed, and strengthened by an official primary source (Gnosis's Q2 2026 report) found independently, which still withholds a loss figure months later. - #12[confirmed][no action needed]in section: Remediation and Service Restoration
“All affected users received replacement Safe accounts linked to their existing physical and virtual Gnosis Pay cards with balances restored to pre-exploit levels.”
reviewerAll affected users received replacement Safe accounts linked to existing cards with balances restored; users had to update deposit addresses or funds would be lost.Confirmed by both the news report and the later official Gnosis quarterly report. - #13[confirmed][no action needed]in section: Remediation and Service Restoration
“By June 7, 2026, Gnosis Pay announced that card services had been restored for over 99% of users.”
reviewerBy June 7, 2026, Gnosis Pay announced card services had been restored for over 99% of users.Confirmed independently by the official Gnosis Q2 report. - #14[confirmed][no action needed]in section: Remediation and Service Restoration
“The Zodiac team stated that more than 95% of identifiable affected accounts had already undergone corrective action before public disclosure of the vulnerability.”
reviewerThe Zodiac team stated that more than 95% of identifiable affected accounts had already undergone corrective action before public disclosure.Directly confirmed by the June 3 CryptoTimes article (not the June 7 one). - #15[confirmed][no action needed]in section: Remediation and Service Restoration
“A full post-mortem was described as pending at the time of reporting, with Zodiac committing to publish it upon completion of the investigation.”
reviewerA full post-mortem was described as pending, with Zodiac committing to publish it on completion of the investigation.Confirmed, and remains true as of the later official report found during this review. - #16[confirmed][no action needed]in section: Scope Limitations and Undisclosed Information
“It also remains unclear whether the reimbursement was completed or remained pending at the time of the June 7 service restoration announcement.”
reviewerScope limitations: exact affected-account count unconfirmed, no comprehensive post-mortem, unclear if reimbursement was complete as of June 7.cryptorank.io blocked direct fetch (403) but indexed search results and syndicated copies (e.g. BitcoinWorld) confirm the same content: compensation mechanism and timeline were still unannounced at publication. - #17[confirmed][no action needed]in section: Context: Gnosis Pay and Safe Infrastructure
“Gnosis Pay is a crypto payment product that links users' Gnosis Chain Safe smart-contract wallets to Visa-branded debit cards, enabling spending of EURe and GNO.”
reviewerGnosis Pay links users' Gnosis Chain Safe smart-contract wallets to Visa-branded debit cards for spending EURe and GNO; Zodiac is a separate open-source modular suite; Delay/Roles Modifiers are optional add-ons, not part of Safe's core.The underlying facts are well-established and independently verifiable via Gnosis Pay's own documentation, even though the specific cited news article only partially backs this background description.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.