Yu Xian, founder of SlowMist, has identified a vulnerability in the Safe Wallet module as the cause of the recent Squid security incident. According to Yu's analysis, the issue was not related to private keys but stemmed from a flaw in the SquidRouterModule used by Safe addresses. This vulnerability allowed attackers to forge messages, bypass verification, and transfer funds from targeted Safe wallets. The incident, which affected 86 Gnosis Safe wallets on Base and Ethereum, resulted in losses of approximately $3.2 million. The exploited contract, known as "SquidRouterModule" on Basescan, was added as a trusted Safe Module by the affected wallets. Despite the breach, Squid has clarified that it was not impacted by the Gnosis Safe-related vulnerability.