author
Ahmed Barakat
author
Share
Ripple News: Squid Crypto closed a $6 million strategic funding round led by North Island Ventures with participation from Ripple on May 25, 2026, and in less than 24 hours, an attacker drained $3 million from the protocol.
The vulnerability affected a third-party liquidity aggregator built into Squid’s cross-chain swap infrastructure, not the audited underlying contracts.
Squid’s official response was to distance itself from the hack entirely, stating that the team did not know who deployed the specific module responsible for the drain.
Squid acts as a meta-DEX and chain stripping protocol, routing cross-chain swaps across multiple networks through pooled liquidity layers.
The $6 million increase was positioned as an incentive to expand interoperability infrastructure Ripple’s involvement It is framed as a strategic alignment with the broader cross-chain and payments roadmap. That narrative collapsed within a single news cycle.
Discover: The best cryptocurrencies to diversify your investment portfolio
Ripple News: How the Squid Crypto Exploit Worked: A vulnerability in the third-party module
The attack vector was a terminal liquidity aggregator that Squid recently integrated to facilitate cross-chain swap routing, a component that lies outside the protocol’s core set of validator contracts.
The attacker exploited manipulated price feeds or misconfigured access permissions within this module to directly exfiltrate assets, bypassing security controls governing Squid’s underlying contracts.
This is a structural pattern that has emerged repeatedly throughout the history of DeFi exploits: audits cover the components provided, not the full dependency tree.
The module in question was a third-party integration layer, which meant that its trust assumptions, permissions logic, and oracle dependencies were never subject to the same scrutiny as native Squid code.
Squid Router’s response Squid Router quickly issued a statement distancing itself from the exploit. The team explained that the drained funds came from a third-party Gnosis Safe module called
SquidRouterModule, which is not built, published or operated by them. They confirmed that their core router nodes were not affected and that all standard and integrated Squid users are safe.
The team noted that the module has been integrated with Squid alongside other protocols without any direct involvement from Squid, and urged the community to avoid confusion between the two due to similar nomenclature. There was no action required from Squid users.
Discover: The best advance token sales
