An attacker attempted to drain approximately $7.7 million in rsETH from a Safe wallet on the Ethereum network. The exploit involved a custom module connected to the wallet, which the attacker used to direct a Uniswap v4 liquidity module into a malicious hooked pool to unwrap aEthrsETH into rsETH.
The theft was intercepted by an MEV bot named Yoink, which front-ran the attacker to capture the funds. Blockchain data indicates that Yoink transferred about 18.93 ETH, valued at roughly $46,000, to a block builder address during the transaction process.
Following the incident, the Kelp protocol implemented a 24-hour freeze on the address that received the stolen tokens. The company stated that this was a precautionary measure and confirmed that its core contracts remain secure, with minting and withdrawal operations continuing as normal.
Security firm Blockaid reported that the total value of the rsETH involved in the incident reached approximately $7.73 million. Kelp is currently working with security experts to investigate the breach, noting that the vulnerability was limited to the victim's custom Safe module.
