Key facts
- An MEV bot captured approximately $7.7 million in rsETH intended for an attacker.
- The attacker attempted to exploit a custom Uniswap v4 liquidity module connected to an Ethereum Safe wallet.
- The MEV bot 'Yoink' intercepted the rsETH before the attacker could.
- Yoink transferred about $46,000 worth of ETH to a block builder.
- Kelp, the protocol behind rsETH, froze the receiving address for 24 hours.
- Kelp stated its own contracts are safe and rsETH remains fully backed.
An attempt to steal approximately $7.73 million in rsETH from an Ethereum Safe wallet was thwarted when an MEV bot front-ran the attacker. The bot, known as Yoink, intercepted the funds before the exploiter could gain control. According to blockchain security firm Blockaid, the attacker used a custom Uniswap v4 liquidity module to unwrap aEthrsETH into rsETH. Yoink then transferred about 18.93 ETH, valued at approximately $46,000, to an address identified as a block builder. In response, Kelp, the protocol behind rsETH, placed the receiving address under a 24-hour pause as a precautionary measure, emphasizing that its own contracts remain secure and rsETH is fully backed. Minting, withdrawals, and integrations are continuing normally while security experts investigate the incident. The apparent attack vector involved the custom module connected to the victim's Safe wallet.