Zodiac Delay Module Bug Lets Attacker Trigger Gnosis Pay Transfers

Overview

• Gnosis co-founder Martin Köppelmann and security firm PeckShield reported on Monday that an active exploit tied to Gnosis Pay is prompting users to withdraw EURe and GNO from affected Safe accounts.
• The vulnerability lies in the Zodiac Delay Module, which is meant to add a short waiting period before outgoing transactions; the bug lets an attacker initiate transactions from Safes that use that module.
• Gnosis has asked bridge validators to pause related cross-chain activity and is coordinating containment steps to slow possible fund movement while security teams investigate the exploit.
• The company has pledged to reimburse all user losses from the incident but has not published a full technical post-mortem or a final loss tally, leaving the scope of affected accounts unclear.
• The breach highlights a recurring risk in modular Safe-based payment designs that connect self-custody wallets to real-world cards and follows other Safe-related thefts reported earlier this year.