Key Takeaways:
- Gnosis Pay's Zodiac delay module bug drained user funds on June 1
- TesseraDAO also reported an exploit with millions in losses
- Gnosis co-founder pledged full reimbursements to affected users
Back
Gnosis Pay, TesseraDAO lose millions as 2 exploits hit crypto in June
Two separate exploits drained millions of dollars from Gnosis Pay and TesseraDAO on June 1, marking a rough start to the month for crypto security.
"We will ensure that all users are made whole," Gnosis co-founder Martin Koppelmann said on X. The company deleted an earlier post urging users to withdraw funds, acknowledging that most could not act on that advice.
The Gnosis Pay exploit targeted the Zodiac delay module, a feature designed to enforce a three-minute cooldown on transactions. Attackers compromised the module to push transactions into users' queues across multiple wallets simultaneously, according to Gnosis. The attack did not compromise users' private keys. Gnosis Pay serves as a self-custodial debit card service supporting stablecoins like EURe on the Gnosis chain.
The incident follows a separate exploit last week that drained more than $3 million from dozens of Gnosis Safe wallets through a compromised community module, SquidRouterModule. It is unclear if the two exploits are connected, but the back-to-back attacks on module-level infrastructure raise questions about smart contract security in real-world payment tools.
Gnosis Pay paused cross-chain transfers as part of its response and addressed UI bugs that prevented users from making withdrawals during the incident. Koppelmann did not disclose specific loss figures but said the team believed it could contain the majority of the damage.
TesseraDAO, a decentralized autonomous organization, also reported an exploit on June 1, adding to the tally of losses across the sector. Details on the TesseraDAO attack remain limited as the team investigates.
The two incidents come as the broader crypto industry faces increased scrutiny over security vulnerabilities. Developers and security researchers have raised concerns that AI-powered tools may be helping exploiters discover vulnerabilities faster, though no direct link has been established in these cases.
This article is for informational purposes only and does not constitute investment advice.
