Skip to content
Ethereum Wallet Exploit Results in $7.8 Million Loss Captured by MEV Bot

Ethereum Wallet Exploit Results in $7.8 Million Loss Captured by MEV Bot

First seen 15 Sep 2026, 18:53 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 15, 2026 at 19:55 UTC
  • •An Ethereum wallet lost $7.8 million due to a custom module exploit.
  • •MEV bot Yoink intercepted the funds before the attacker could access them.
  • •Kelp DAO temporarily paused rsETH transfers to mitigate the impact.

On September 15, 2026, an Ethereum wallet lost approximately $7.8 million in rsETH due to an exploit of a custom Safe module linked to a Uniswap v4 liquidity pool. The attacker utilized a public keeper multicall to redirect the wallet's custom module to a malicious hooked pool, where aEthrsETH was unwrapped into raw rsETH. However, the funds were intercepted by an MEV bot named Yoink before the attacker could access them. The affected wallet was identified by blockchain security firm Blockaid, which reported the loss of $7.73 million in rsETH. Kelp DAO, the protocol behind rsETH, responded by pausing transfers for 24 hours to isolate the affected funds and confirmed that its core contracts were safe. The incident highlights vulnerabilities in custom modules used with Ethereum wallets, emphasizing the need for robust security measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-15
Exploit of Ethereum wallet confirmed
An attacker exploited a custom Safe module linked to a Uniswap v4 liquidity pool, resulting in a loss of approximately $7.8 million in rsETH.
Tradingview
2026-09-15
MEV bot intercepts funds
The MEV bot Yoink captured the stolen rsETH before the original attacker could access it, highlighting the risks of transaction front-running.
Tradingview
2026-09-15
Kelp DAO pauses rsETH transfers
Kelp DAO temporarily froze the address that received the rsETH to prevent further transfers and confirmed that its core contracts were unaffected.
Tradingview

More articles in this cluster (2)

Following this threat?

Track Gnosis Safe in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3