A hacker had roughly $7.8 million in rsETH lined up for the taking on Ethereum this week. A bot got there first.
The exploit targeted a Safe multi-signature wallet through a Multicall contract the owner had authorized to execute batched transactions. According to CoinDesk reported, the attacker used a public keeper multicall to route a custom liquidity module through an attacker-controlled Uniswap v4 hooked pool, dumping around 2,900 rsETH into a trading pair built minutes earlier around a token with no real value. The wallet was left holding a worthless receipt while the attacker's transaction sat in the public mempool waiting to settle.
That delay is what killed the theft. A generalized MEV searcher operating under the tag "Yoink" spotted the pending transaction, landed in the same block, and paid roughly $47,000 in fees to jump the queue. Instead of the attacker taking the tokens, Yoink's bot captured 2,882 rsETH and moved them to a separate address it controls — intercepting close to $7.7 million of the $7.8 million at risk before the original exploit could finalize.
Four independent security firms — BlockSec, Blockaid, SlowMist, and AstraSec — reviewed the incident and reached the same conclusion: the flaw sat in the Multicall component the wallet owner had chosen to authorize, not in Safe's core smart contracts. That distinction matters for the roughly 200,000 Safe wallets holding billions in assets across Ethereum and its rollups — the exploit says nothing about the safety of Safe's own code, but it is a reminder that the modules and permissions layered on top of a multisig carry their own, separate attack surface. Uniswap v4's hook system has drawn similar scrutiny in recent weeks, with one DEX aggregator flagging that more than half of live hooks it scanned showed malicious or exploitable behavior — the same permissionless hook architecture the attacker leaned on here to build a throwaway pool in minutes.
Related: Chainflip Halts Tron Route After Attacker Double-Spends $736K in USDT
Kelp DAO, which issues rsETH as a liquid restaking token backed by staked ether, moved quickly once the exploit surfaced. The protocol placed a 24-hour pause on the address that received the stolen tokens, giving investigators a window to trace the funds, while stating that its core contracts and the ETH backing rsETH itself were never at risk — the exploit lived entirely in the victim's wallet configuration, upstream of Kelp's own infrastructure. Similar containment moves have become standard practice this year, echoing how Osmosis paused BTC alloyed minting after a bridge-side security incident rather than waiting for a full post-mortem.
What happens to the 2,882 rsETH the bot now holds is an open question. MEV searchers that intercept stolen funds occasionally negotiate a return for a cut of the total, treating the interception as a de facto whitehat rescue; others simply keep what they capture, arguing finders-keepers applies once a transaction lands on-chain. Either way, the practical outcome for this exploit is that an attacker who nearly walked away with $7.8 million in rsETH will likely end up with nothing, while a bot with no stated affiliation to Kelp DAO, Safe, or the victim ends up holding the tokens instead.
FAQ
Was Safe's own wallet software compromised in this exploit?
No. Security firms BlockSec, Blockaid, SlowMist, and AstraSec all traced the flaw to a Multicall contract the wallet owner had separately authorized, not to Safe's core multisig code.
What is rsETH and why did Kelp DAO get involved?
rsETH is Kelp DAO's liquid restaking token, backed by staked ether. Kelp paused the address that received the stolen tokens for 24 hours while confirming its own contracts and the token's backing were unaffected.
How much did the MEV bot pay to intercept the exploit?
The bot, tagged "Yoink," paid about $47,000 in transaction fees to land ahead of the attacker in the same block and redirect 2,882 rsETH to its own address.
How did the attacker try to launder the stolen tokens?
By routing them through a Uniswap v4 pool built minutes earlier around a near-worthless token, a tactic that exploits the permissionless nature of v4's hook system to obscure the trail quickly.
