A 7.7 Million USD Crypto Theft Got Stolen From the Thief: How an MEV Bot Hijacked an rsETH Exploit in Real Time

A thief tried to steal 7.7 million USD worth of rsETH on Tuesday and lost the money to a faster robot. An attacker exploited a custom module attached to an Ethereum Safe wallet, according to blockchain security firm Blockaid — but before the funds could land in the attacker’s control, an automated MEV bot known as Yoink intercepted the entire haul in the same block. Kelp, the protocol behind rsETH, has since frozen the receiving address for 24 hours.

By Amir Hassan | September 15, 2026

The Hook: A Robbery Interrupted by a Bigger Opportunist

Here is what happened in plain English. The victim owned a Safe wallet — think of it as a bank account with programmable add-ons. One of those add-ons, a custom Uniswap v4 liquidity module, had a weakness. The attacker used a public keeper multicall to trick that module into dumping the wallet’s aEthrsETH into a malicious hooked pool the attacker had created, unwrapping it into rsETH — the liquid restaking token issued by Kelp.

The problem for the thief? Everything on a public blockchain is visible before it is final. An MEV bot — an automated program that watches pending Ethereum transactions for profitable opportunities — saw the exploiter’s transaction sitting in the queue and paid more in fees to jump ahead of it. The bot, Yoink, grabbed the roughly 7.73 million USD in rsETH before the attacker could. Onchain data from Etherscan shows Yoink paid about 18.93 ETH, worth roughly 46,000 USD, to an address labeled as a block builder in the same transaction. That fee is essentially the bot bidding to have its transaction processed first.

On-Chain Evidence: What Blockaid and Kelp Found

Blockaid, the security firm that first flagged the incident, identified the affected wallet as a Safe belonging to an unidentified user and estimated the loss at about 7.73 million USD in rsETH at the time of its initial report. The key detail is where the weakness lived: in the custom module connected to the victim’s wallet, not in Kelp’s own code.

• The victim: an individual user’s Safe wallet with a custom Uniswap v4 liquidity module attached.
• The exploit: a public keeper multicall routed the module into an attacker-created hooked pool, unwrapping aEthrsETH into rsETH.
• The twist: the MEV bot Yoink front-ran the attack transaction and captured the rsETH first.
• The response: Kelp placed the receiving address under a 24-hour pause, blocking transfers of the tokens.

The Core Conflict: Is Your Money Safer With a Protocol or a Wallet Add-On?

Kelp moved quickly to reassure holders. “This is a precautionary, wallet-level measure only,” the protocol said. “Kelp contracts are safe, rsETH remains fully backed.” Minting, withdrawals and integrations continued to work normally while Kelp worked with security experts to investigate.

That distinction matters a lot for regular investors. When a protocol’s core contracts are hacked, every holder is exposed. When a user’s wallet customization is hacked, only that user loses. This incident was the second kind — closer to someone breaking into one house than burning down the whole neighborhood. Ethereum itself traded around 2,504 USD after the news, showing no market-wide panic.

The uncomfortable part is that the money is now frozen in limbo, held by a bot whose operators have every incentive to keep it, while the original victim and Kelp negotiate. Front-running is a double-edged feature of Ethereum’s design: transparent blockchains let anyone see pending transactions, and “paying to cut in line” is legal and automated. Today that mechanic accidentally protected the funds from a thief — by stealing them with a different thief.

Market Implications: Custom Modules Are the New Attack Surface

For everyday investors, the lesson is not “avoid rsETH” or “avoid Safe wallets” — both behaved as designed here. The lesson is about add-ons. Every custom module, hook or automation you attach to a wallet is extra code that can fail. The safest setup is boring: a well-audited wallet, minimal third-party plugins, and permissions you actually understand.

It is also a reminder of how fast onchain responders can move. Within minutes of the attack, a private bot had intercepted the funds, and within hours the protocol had paused the receiving address. Cointelegraph contacted Blockaid and Kelp for additional comment but had not received a response by publication.

The Verdict

A 7.7 million USD heist failed because a robot was greedier than the hacker. Kelp’s contracts were never touched, rsETH remains fully backed, and the stolen funds are frozen for 24 hours while investigators work. For holders, that is about the best possible outcome from a bad situation. For anyone using clever wallet add-ons, it is a good day to audit what you have plugged in.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.