rsETH Exploit Drains $7.73M From Ethereum Safe Wallet

According to Blockaid, the attacker targeted one wallet’s configuration rather than any core protocol. Kelp DAO, the issuer of rsETH, quickly paused the address holding the stolen tokens. It also stressed that its contracts remain safe.

How the rsETH Exploit Unfolded

The victim Safe had enabled a custom Uniswap V4 liquidity module. That module was allowed to move the wallet’s assets without a fresh multisig signature on every call.

Next, the attacker used a public keeper multicall to drive that module. Because the path was permissionless, anyone could trigger it. The attacker then pointed the module at a Uniswap V4 pool they had created, one that carried a malicious hook.

Finally, the hook unwrapped aEthrsETH into raw rsETH. In effect, it burned Aave’s interest-bearing receipt token and withdrew the underlying rsETH. As a result, the tokens became a freely transferable asset that could leave the Safe’s control.

The full drain happened around 04:38 UTC in block 25980525. Blockaid’s figure of $7.73 million matches roughly 2,882 rsETH at recent prices.

An MEV Bot Called Yoink Stole the Steal

Here is the twist that set this incident apart. The original attacker built the path, yet a separate MEV bot named Yoink captured the value first.

Yoink front-ran the extraction in the same block. Therefore the bot, not the original attacker, ended up controlling the proceeds. PeckShield put the intercepted total at about $7.81 million, a slightly higher print than Blockaid’s due to price timing.

So far, there is no public confirmation that Yoink has returned the funds. Analyst Vishal Chawla, summarizing PeckShield, said a return is expected but not committed.

Where the Stolen rsETH Sits Now

Roughly 2,882 rsETH now rests at the address 0xC70f00CD...80ea0. PeckShield confirmed the funds currently sit there. So far, no evidence points to a mixer, an exchange deposit, or a bridge.

Shortly after, Kelp DAO placed that address under a temporary 24-hour pause. During that window, rsETH cannot move in or out of it.

Meanwhile, Kelp said its contracts are safe and rsETH stays fully backed. It added that minting, withdrawals, and integrations all run normally, so no user action is required.

Why the Safe Module Was the Weak Point

A Safe is a smart-contract wallet, and owners can enable modules to automate tasks. However, a module with broad permissions can also move the tokens a wallet holds. That power is exactly what this rsETH exploit abused.

According to secondary write-up Telem News, the loss stemmed from module authorization abuse within the victim’s account. It did not stem from a flaw in Safe’s core protocol. Blockaid’s framing points the same way.

Still, some open questions remain. Blockaid has not published verified addresses for the custom module or the malicious hook. Consequently, the exact misconfiguration stays partly inferred for now.

Uniswap V4 Hooks Draw Scrutiny Again

Uniswap V4 lets any pool attach a hook contract that runs custom code during swaps or liquidity changes. Moreover, pool creation is permissionless, so anyone can deploy a pool whose hook runs attacker logic.

This is not the first hook-linked loss. Trail of Bits has cited two recent cases. The Cork incident lost near $12 million in May 2025. The Bunni hook loss hit $8.4 million in September 2025. Both were application-level failures, not a break in the Uniswap V4 core.

The pattern echoes earlier Safe module trouble too. In May 2026, a third-party SquidRouterModule drained about $3.2 million from 86 Safes through overly broad permissions.

rsETH Price Holds as the Market Shrugs

Despite the headlines, there is no sign of an rsETH depeg tied to this drain. The theft hit one wallet, not the roughly $1.06 billion token supply behind rsETH.

According to DefiLlama, rsETH traded near $2,685 with a 24-hour move of about -0.59%. Kelp’s total value locked sat around $1.09 billion, up 26.2% over 30 days.

For context, some users quickly linked this event to April’s $292 million Kelp bridge hack. That comparison misleads, though. April involved unbacked minting through a forged bridge message, while today’s rsETH exploit drained already-backed tokens from one Safe.

What Comes Next for the rsETH Exploit

Several answers are still pending. Investigators have not named the attacker. No one has confirmed whether Yoink will return the funds when the pause lifts.

For now, the takeaway is practical. A Safe wallet is only as safe as the modules its owner enables. Permissionless V4 hooks also remain an attack surface worth watching. Traders and treasuries should audit every module and keeper that can touch their funds.

This article is informational and not financial advice. Always verify on-chain data and manage risk before interacting with any DeFi protocol.