Ripple-backed DeFi router suffers $3M exploit

TLDR

A newly funded, Ripple-backed DeFi router project called Squid was hit by an exploit that drained about 3 million dollars via a third party module.

1. Squid raised 6 million dollars with Ripple participating, then within a day an attacker abused a peripheral liquidity module to steal roughly half that amount.
2. The exploit hit a third party Gnosis Safe module integrated with Squids router, not Squids audited core contracts, so regular Squid users reportedly did not lose funds.
3. The incident highlights growing supply chain risk in DeFi and raises reputational but not technical contagion risk for Ripple backed projects, making contract dependencies more important to monitor.

Deep Dive

1. What Happened In The Exploit

Squid Crypto is a meta DEX and chain abstraction router that aggregates liquidity to route cross chain swaps.

According to multiple reports, Squid closed a 6 million dollar strategic round led by North Island Ventures with participation from Ripple on 25 May, then less than 24 hours later an attacker drained about 3 million dollars via a vulnerability in its infrastructure. The attack targeted a third party liquidity aggregation component called SquidRouterModule on Ethereum and Base, affecting around 86 Gnosis Safes whose assets were siphoned and swapped to DAI via attacker controlled Uniswap V3 pools.

This sequence is detailed in coverage of the Ripple backed Squid exploit and a follow up Yahoo Finance summary.

2. How The Vulnerability Worked And Who Was Exposed

The exploited module sat outside Squids audited core router contracts. Reports describe manipulated price feeds or misconfigured permissions inside this peripheral module, allowing the attacker to bypass Squids main security controls and drain funds directly from affected safes.

Squids team publicly stated that they did not build, deploy, or operate the compromised Gnosis Safe module and that their core router and standard Squid users and integrators were unaffected, with no user action required. The damage appears confined to entities that opted into the specific module integration rather than all Squid users.

3. Implications For Ripple And DeFi Security

Ripples role here is as a strategic investor in Squid, not as a technical operator, so there is no indication that XRP, RLUSD, or XRPL infrastructure were touched. The main impact for Ripple is reputational, since a high profile portfolio company suffered a major loss immediately after a celebrated raise.

For DeFi broadly, this reinforces a pattern seen in recent exploits where off core components, bridges, and third party modules are compromised even when headline contracts are audited. Dependency trees, Gnosis Safe modules, and integration layers now require the same scrutiny as primary contracts.

Conclusion

The Squid exploit shows how quickly new capital and narrative momentum can be reversed when a single weak integration module fails, even around an audited, Ripple backed DeFi router. The direct technical blast radius appears limited to a specific Gnosis Safe module, but the episode strengthens the case for deeper audits of dependencies and more conservative use of third party components in cross chain routing stacks.