MEV Bot Front-Runs $7.8 Million rsETH Exploit on Ethereum on September 15

A sophisticated MEV bot named Yoink intercepted an exploit targeting a Safe wallet on Ethereum on September 15, capturing approximately $7.81 million in rsETH before the original attacker could move the funds. The incident illustrates both the efficiency of automated front-running bots and the stacked risks facing smart wallet infrastructure when custom modules are integrated.

According to The Defiant's reporting, security firms BlockSec and Blockaid traced the exploit to a flawed authorization check in an executor contract connected to an enabled Safe module. The flaw allowed attacker-controlled calls to execute through the trusted executor, bypassing the wallet's intended access controls. BlockSec said the attacker then used a public keeper multicall to steer a custom Uniswap v4 liquidity module into an attacker-created hooked pool, which unwrapped aEthrsETH into rsETH. The exploit moved approximately 2,900 aEthrsETH into a Uniswap v4 pool paired with a token called Permissionless Attacker Token, leaving the Safe with a liquidity-position NFT instead of the original tokens.

The Yoink MEV bot's transaction occupied position zero in Ethereum block 25,980,525 at 12:38 a.m. ET, placing it ahead of the original attack transaction, which encountered an execution revert. On-chain data confirmed that Yoink received 2,900 rsETH and sent 2,882.37 rsETH to address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, per The Defiant's reporting. Etherscan displayed a balance of exactly 2,882.36740883 rsETH at that address. The Yoink transaction then sent 17.63 rsETH to Uniswap's v4 Pool Manager, which returned 18.95 ETH to the Yoink contract; Yoink forwarded 18.93 ETH to the block builder.

PeckShield described the incident as an approximately $7.81 million rsETH exploit, according to The Defiant. Security firms traced the $7.8 million loss to a helper contract the wallet owner had authorized, not to Safe itself, underscoring that the vulnerability lay in user-enabled integration rather than Safe's core protocol. Kelp, the issuer of rsETH, froze the receiving address after the incident.

The exploit exposes a structural risk in modular wallet design: enabling custom helper contracts for specific functions can introduce authorization gaps that sophisticated attackers can exploit, while the same blockchain infrastructure that enables attacks also powers MEV bots capable of intercepting them mid-transaction. In this case, the bot's automated extraction of value did prevent the attacker from realizing the full target amount, but the mechanism of that prevention (sandwich-trading the attacker's own transaction) raises questions about whether victims gain or simply see their loss redirected to bot operators.