Gnosis Pay users were urged to pull their funds immediately after Gnosis co-founder Martin Köppelmann and blockchain security firm PeckShield warned of an active exploit tied to the platform’s Zodiac delay module. “If you are a Gnosis Pay user – unfortunately I have to recommend: withdraw all funds (EURe and GNO),” Köppelmann posted on X, and PeckShield issued a matching alert telling users to “check your exposure, as you may be affected.” What’s happening - The vulnerability is linked to the Zodiac delay module used by Gnosis Pay’s Safe-based accounts. Köppelmann said the bug allows an attacker to initiate transactions from Safes that use the delay module, effectively bypassing the short waiting period the module is meant to enforce. - In normal operation the Delay Module imposes a brief pause before outgoing transactions execute, giving users time to react. The exploit undermines that safeguard and lets the attacker start transfers from affected accounts. Gnosis’s response - Gnosis is taking containment steps, including asking bridge validators to pause operations to slow cross-chain movement of potentially compromised funds. Köppelmann said the team is implementing “various measures to contain the damage.” - He also reassured users that “Gnosis will cover all user losses.” At the time of the alert no total loss figure or full post‑mortem had been published, and Gnosis has not yet disclosed how many accounts were affected or whether attacker activity has fully stopped. Why this matters - Gnosis Pay is a self‑custody card product that connects blockchain wallets to Visa merchants. Its accounts rely on smart contract modules — notably the Delay Module and a Roles Module — to enable card payments while keeping users in control. That architecture is designed for convenience but places heavy importance on the correctness of the modules that control permissions and transaction timing. What users should do - Follow the warnings from Köppelmann and PeckShield: withdraw EURe and GNO from Gnosis Pay accounts and check any exposure to affected Safes while the team investigates. The platform has not been described as shut down; rather, users are being told to remove funds while Gnosis works with outside providers and infrastructure partners to contain the incident. More details and a post‑mortem are expected once the investigation advances. Read more AI-generated news on: undefined/news