Gnosis Pay Exploit Hits Delay Module, Founder Guarantees Full Refund

Gnosis Pay, the cost infrastructure tied to the Ethereum-based Gnosis ecosystem, is grappling with an exploit focusing on its Delay Module. Co-founder Martin Köppelmann confirmed the hack on June 1, 2026, initially urging customers to withdraw affected funds in EURe and GNO tokens. Nonetheless, he later retracted the withdrawal suggestion, acknowledging that almost all customers could be unable to retrieve funds because of the exploit’s nature. Köppelmann assured customers that Gnosis would absolutely cowl any monetary losses incurred.

The delay module, a key a part of Gnosis Pay’s design, queues outgoing transactions for 3 minutes to make sure settlement accuracy and forestall rapid unauthorized withdrawals. In line with former Close to Protocol developer Vadim Zacodil, the module’s shared queuing layer, which processes transactions for a number of customers concurrently, was doubtless the supply of the vulnerability. This setup means a single exploit might compromise hundreds of person accounts directly, regardless of the self-custodial nature of particular person Protected wallets.

This incident raises recent safety issues, coming lower than per week after a separate exploit on Might 25, 2026, drained $3.2 million from 86 Protected wallets. That assault, involving a rogue third-party module known as SquidRouterModule, highlighted the dangers of integrating unverified modules into Protected wallets. Whereas the Gnosis Protected core protocol was not compromised, the fast succession of those occasions has solid a highlight on module governance and execution dangers throughout the ecosystem.

Unanswered Questions and Market Influence

Key particulars in regards to the present exploit stay unclear, together with the overall quantity stolen, the particular contracts affected, and whether or not the vulnerability lies within the Delay Module itself or its configuration inside Gnosis Pay. Restricted communication from Gnosis as of publication has left customers and analysts at midnight relating to the exploit’s full scope.

Safety agency PeckShield, which amplified Köppelmann’s preliminary withdrawal warning, has but to launch an in depth autopsy. In the meantime, Gnosis’s potential to pause infrastructure and commit treasury funds to reimburse customers gives some injury management, nevertheless it additionally underscores the dependency on centralized responses in ostensibly decentralized techniques.

DeFi Safety Classes and Broader Tendencies

The timing of the Gnosis Pay exploit coincides with a broader pattern of lowered crypto losses from hacks. Information from CertiK signifies that Might 2026 noticed complete crypto exploit losses fall to $68.3 million, a pointy 90% drop from April and one of many lowest month-to-month totals of the yr. Nonetheless, the latest string of module-related hacks focusing on Gnosis-affiliated merchandise highlights a persistent vulnerability within the DeFi house: the safety of modular good contract techniques.

Gnosis Pay accounts depend on two major modules: the Delay Module, which enforces the three-minute transaction queue, and the Roles Module, which units programmable transaction limits. Whereas these options improve performance, additionally they introduce further assault vectors. The Might 25 and June 1 incidents display how even modules designed to reinforce safety can turn into liabilities if exploited.

For merchants and DeFi contributors, the Gnosis Pay incident underscores the significance of scrutinizing pockets configurations, particularly when third-party modules are concerned. The concentrate on sustaining person belief will doubtless result in elevated scrutiny of module verification processes throughout the Gnosis ecosystem and past.

Because the Gnosis workforce works to include the present exploit and compensate customers, the incident serves as a reminder of the evolving dangers in decentralized finance. Till extra sturdy safeguards are applied, the stability between innovation and safety will stay precarious.

Picture supply: Shutterstock