Back Thedefiant

MEV Bot Front-Runs $7.8 Million rsETH Exploit on Ethereum

Thedefiant • September 15, 2026

An MEV bot known as Yoink front-ran an exploit targeting a Safe wallet on Ethereum on Tuesday. PeckShield described the incident as an approximately $7.81 million rsETH exploit.

Onchain records show the Yoink transaction received 2,900 rsETH and sent 2,882.37 rsETH to `0xC70f00CD7E461686b04B0E912E309becA8b80ea0`. When checked, Etherscan displayed a balance of exactly 2,882.36740883 rsETH at that address.

The same transaction sent 17.63 rsETH to Uniswap's v4 Pool Manager. The pool sent 18.95 ETH to the Yoink contract, which forwarded 18.93 ETH to the block builder.

Yoink's transaction and the original attack transaction landed in Ethereum block 25980525 at 12:38 a.m. ET. The Yoink transaction occupied position zero in the block, while the original transaction encountered an execution revert. That ordering is consistent with security researchers' finding that Yoink front-ran the attack.

A Flawed Module Check

BlockSec attributed the exploit to a flawed authorization check in an executor contract connected to an enabled Safe module. The firm said attacker-controlled calls could execute through the trusted executor.

Blockaid said the attacker used a public keeper multicall to steer a custom Uniswap v4 liquidity module into an attacker-created hooked pool. The hook then unwrapped aEthrsETH into rsETH.

BlockSec said the exploit moved 2,900 aEthrsETH into a Uniswap v4 pool paired with a token called Permissionless Attacker Token, leaving the Safe with a liquidity-position NFT. The identified target was an unidentified user's Safe using a custom module, according to Blockaid.

The address that received 2,882.37 rsETH in the Yoink transaction displayed 2,882.36740883 rsETH when checked.

Our articles are stored on Filecoin.

Get an edge in Crypto with our free daily

Know what matters in Crypto and Web3 with The Defiant Daily , Mon to Fri

Bitget Wallet Adds Reality's Tokenized U.S. Stocks Alongside Ondo And xStocks

Standard Chartered Sets $10 Arbitrum Target on Robinhood and Tokenization Growth

Bitcoin Falls Below $76,000 as Traders Cut CLARITY Act Odds Hours Before Senate Vote

Will crypto get clarity? Senate votes today

XRP Leads a Broad Crypto Bid on the Eve of a Senate Vote and a Fed Decision

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ethereum Wallet Exploit Results in $7.8M Loss Captured by MEV Bot On September 15, 2026, an Ethereum wallet lost approximately $7.8 million in rsETH due to an exploit involving a custom Safe module linked to a Uniswap v4 liquidity pool. The attacker manipulated a public keeper multicall to redirect the wallet's module to a malicious pool, allowing unauthorized access to the funds. However, an MEV bot named Yoink front-ran the exploit, capturing the funds before the attacker could finalize the transaction. The incident highlights vulnerabilities in the authorization checks of the executor contract associated with the Safe module. Kelp DAO, the protocol behind rsETH, has temporarily paused transfers to isolate the affected funds, confirming that its core contracts remain secure. No recovery or legal actions have been reported yet, and the incident adds to the ongoing concerns regarding DeFi security in 2026. 4 sources 69

Extracted Entities

MEV Bot Front-Runs $7.8 Million rsETH Exploit on Ethereum

The full story

Extracted Entities

Companies (3)

CWE Weaknesses (1)

eth (1)

Platforms (1)

Tools (1)