A thief tried to steal 7.7 million USD worth of rsETH on Tuesday and lost the money to a faster robot. An attacker exploited a custom module attached to an Ethereum Safe wallet, according to blockchain security firm Blockaid — but before the funds could land in the attacker’s control, an automated MEV bot known as Yoink intercepted the entire haul in the same block. Kelp, the protocol behind rsETH, has since frozen the receiving address for 24 hours.
By Amir Hassan | September 15, 2026
The Hook: A Robbery Interrupted by a Bigger Opportunist
Here is what happened in plain English. The victim owned a Safe wallet — think of it as a bank account with programmable add-ons. One of those add-ons, a custom Uniswap v4 liquidity module, had a weakness. The attacker used a public keeper multicall to trick that module into dumping the wallet’s aEthrsETH into a malicious hooked pool the attacker had created, unwrapping it into rsETH — the liquid restaking token issued by Kelp.
The problem for the thief? Everything on a public blockchain is visible before it is final. An MEV bot — an automated program that watches pending Ethereum transactions for profitable opportunities — saw the exploiter’s transaction sitting in the queue and paid more in fees to jump ahead of it. The bot, Yoink, grabbed the roughly 7.73 million USD in rsETH before the attacker could. Onchain data from Etherscan shows Yoink paid about 18.93 ETH, worth roughly 46,000 USD, to an address labeled as a block builder in the same transaction. That fee is essentially the bot bidding to have its transaction processed first.
On-Chain Evidence: What Blockaid and Kelp Found
Blockaid, the security firm that first flagged the incident, identified the affected wallet as a Safe belonging to an unidentified user and estimated the loss at about 7.73 million USD in rsETH at the time of its initial report. The key detail is where the weakness lived: in the custom module connected to the victim’s wallet, not in Kelp’s own code.
- The victim: an individual user’s Safe wallet with a custom Uniswap v4 liquidity module attached.
- The exploit: a public keeper multicall routed the module into an attacker-created hooked pool, unwrapping aEthrsETH into rsETH.
- The twist: the MEV bot Yoink front-ran the attack transaction and captured the rsETH first.
- The response: Kelp placed the receiving address under a 24-hour pause, blocking transfers of the tokens.
The Core Conflict: Is Your Money Safer With a Protocol or a Wallet Add-On?
Kelp moved quickly to reassure holders. “This is a precautionary, wallet-level measure only,” the protocol said. “Kelp contracts are safe, rsETH remains fully backed.” Minting, withdrawals and integrations continued to work normally while Kelp worked with security experts to investigate.
That distinction matters a lot for regular investors. When a protocol’s core contracts are hacked, every holder is exposed. When a user’s wallet customization is hacked, only that user loses. This incident was the second kind — closer to someone breaking into one house than burning down the whole neighborhood. Ethereum itself traded around 2,504 USD after the news, showing no market-wide panic.
The uncomfortable part is that the money is now frozen in limbo, held by a bot whose operators have every incentive to keep it, while the original victim and Kelp negotiate. Front-running is a double-edged feature of Ethereum’s design: transparent blockchains let anyone see pending transactions, and “paying to cut in line” is legal and automated. Today that mechanic accidentally protected the funds from a thief — by stealing them with a different thief.
Market Implications: Custom Modules Are the New Attack Surface
For everyday investors, the lesson is not “avoid rsETH” or “avoid Safe wallets” — both behaved as designed here. The lesson is about add-ons. Every custom module, hook or automation you attach to a wallet is extra code that can fail. The safest setup is boring: a well-audited wallet, minimal third-party plugins, and permissions you actually understand.
It is also a reminder of how fast onchain responders can move. Within minutes of the attack, a private bot had intercepted the funds, and within hours the protocol had paused the receiving address. Cointelegraph contacted Blockaid and Kelp for additional comment but had not received a response by publication.
The Verdict
A 7.7 million USD heist failed because a robot was greedier than the hacker. Kelp’s contracts were never touched, rsETH remains fully backed, and the stolen funds are frozen for 24 hours while investigators work. For holders, that is about the best possible outcome from a bad situation. For anyone using clever wallet add-ons, it is a good day to audit what you have plugged in.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
hacker spends effort exploiting a Safe module and Yoink just pays 46k in fees to yoink 7.7 million first. darkest timeline for him, funniest for the rest of us
the custom Uniswap v4 hook module is the scary part of this story. a Safe is only as safe as the random junk people bolt onto it
Kelp freezing the receiving address for 24 hours is smart, buys negotiation time. question is whether Yoink returns any of it or just keeps it
the 24h freeze only matters if the bot actually holds the rsETH. best case for kelp is yoink negotiating a bounty and returning most of it, these bots have done that before
yoink has returned funds in past cases once bounties hit around 10 percent. kelp should already be on the phone
exactly, and 10 percent of 7.7M is 770k for a bot that risked 46k in fees. yoink holds all the cards in that negotiation, kelp better open with 15
kelp cant even negotiate that hard, the 24h freeze expires and then what. 10 percent and everyone goes home is the boring ending here too
kelp opening at 15 and settling around 10 is exactly how these end. that 24h freeze clock does most of the negotiating for them
10 percent precedent helps but yoink only gets paid if kelp moves fast. that 24h freeze clock is leverage, not a deadline
past yoink returns were on much smaller hauls. 7.7M changes the math, 770k bounty versus walking away, id ghost them too
watch for the bounty negotiation. kelp freezing the address for 24h plus yoink holding the bag sets up the classic whitehat return minus a fee. these endings are usually boring, sadly
imagine pulling off a 7.7M Safe exploit and Yoink front-runs you in the same block. toughest timeline for that hacker
18.93 ETH in builder fees to win one block race. yoink risked 46k to grab 7.7M, the hacker got outplayed at his own front-running game
18.93 ETH in builder fees to win one block race, that is a 46k bet grabbing 7.7M in the same block as the exploit. the hacker got front run at his own game and it is not even close
46k in builder fees to grab 7.7M is still the best ROI trade of the quarter tbh
Kelp freezing the receiving address for 24h is smart but the money is already gone with the MEV bot. Curious how the negotiation goes.
the exploit vector was a custom uniswap v4 module on a Safe. every custom module is basically a self written exploit waiting its turn
blockaid pinning it on the custom module and not kelp core is the detail that matters. rsETH itself held, someone bolted a sketchy uniswap v4 hooked pool onto their Safe and that was the whole vulnerability
custom uniswap v4 hook module on a Safe is the whole lesson here. core rsETH never broke, someone bolted unaudited junk onto their own wallet and the module did exactly what it was written to do
the hacker watched his own exploit get front run in the same block. mempool really is the final boss
the keeper multicall being public infrastructure is the detail for me. he ran the exploit through a road anyone can watch, yoink read the memo mid flight
kelp got insanely lucky the exploiter was greedy enough to route through a public pool. if the exit had gone to a private solver yoink never sees a cent of it
route it through a private solver instead and this is a normal 7.7M exit with a tidy postmortem. greed beat discretion in the same block
eth sitting at 2,504 like nothing happened is the real tell. the market priced a wallet level hack in minutes, only the comment section is still shocked
18.93 ETH in builder fees to intercept a live hack is the most honest pricing of blockspace priority ive ever seen. the bounty negotiation is the real story now
18.93 ETH to front-run a live robbery is just an arb like any other. yoink didnt save anyone, it outbid the thief for the same stolen goods lol
outbidding the thief for 18.93 ETH is still the cheapest 7.7M recovery in crypto history. kelp lowballing the bounty now would be peak stupidity