Gnosis Pay Zodiac Delay Module Exploit

On June 1, 2026, Gnosis Pay suffered an active exploit that drained roughly $1.5 million in EURe, GNO and USDC.e from thousands of user Safes after an attacker bypassed the service's time-delay safeguard by abusing a signature-verification flaw in the Zodiac Delay Module. Gnosis absorbed the loss and ultimately restored 100% of affected user funds.

What happened

Gnosis Pay wraps each self-custodial card account in a Gnosis Safe protected by a Zodiac Delay Module — a time-lock that is supposed to queue outgoing transactions and require valid signatures before execution. The exploit centered on the module's moduleTxSignedBy() routine, which parsed the r, s, and v signature components directly from msg.data calldata in a way the attacker could manipulate to satisfy the authorization check without a legitimate signature. That let crafted transactions slip past the delay and pull funds straight out of the affected Safes. Zodiac later confirmed the flaw lived in the Delay Module and that core Gnosis Safe contracts were unaffected — a containment line that echoes the New Market Trading module exploit weeks earlier, where the danger again sat in third-party Safe tooling rather than Safe itself.

Aftermath

Co-founder Martin Köppelmann confirmed the incident and pledged that Gnosis would reimburse all affected users, while the team asked bridge validators to pause activity to limit the spread. Gnosis Pay said the incident was fully contained by June 2 and that operations would resume in phases. The attacker, however, moved quickly to launder: roughly $246,000 was bridged out toward Hyperliquid and partly swapped into Monero (XMR), so the stolen funds themselves were not recovered even as users were made whole. By June 7, Gnosis Pay reported it had restored card services for more than 99% of users, having replaced all affected Safe accounts and re-linked them to users' existing physical and virtual cards.

On July 3, 2026, Gnosis Pay published a full post-mortem that revised the scope far beyond CertiK's early $265,000 estimate: the attacker had in fact drained roughly $1.5 million — about $641,000 in GNO, $453,000 in EURe and $339,000 in USDC.e — across 5,281 wallets, with a further ~$300,000 temporarily frozen, bringing total affected assets to roughly $1.8 million. The report traced the root cause to the Zodiac Delay and Roles modules, whose ERC-1271 signature check never verified that the underlying contract call actually succeeded — letting the attacker forge approvals and queue unauthorised withdrawals through a flaw that had sat in Zodiac v3.4.0 since October 30, 2023. Gnosis confirmed it restored 100% of affected user funds, absorbing the loss internally even though the stolen crypto was laundered and never recovered on-chain.

Why it matters

The Gnosis Pay incident shows that security modules are themselves attack surface — a time-delay meant to add safety became the single point of failure when its signature parsing could be gamed. Together with New Market Trading and the same-week TesseraDAO mint, it marks an early-June 2026 cluster of Safe-adjacent and key-driven losses, and reinforces a recurring catalogue lesson: bolt-on Safe modules carry full asset authority and must be audited as rigorously as the vault they guard.