Safe Wallet Exploit Loses $7.7M in rsETH to MEV Bot
A Safe wallet exploit involving a custom module led to the loss of about $7.7 million in rsETH on Ethereum. Blockaid said a public keeper multicall routed the wallet’s custom Uniswap v4 liquidity module into an attacker-controlled hook pool, converting aEthrsETH, an Aave-linked position representing deposited rsETH, into transferable rsETH.
An MEV bot known as Yoink front-ran the profitable transaction path and captured the assets in the same block. Etherscan data also showed that Yoink transferred about 18.93 ETH, worth roughly $46,000, to an address labelled as a block builder. The Safe wallet exploit appears to have involved the custom module and malicious Uniswap v4 hook, rather than a vulnerability in Safe’s core contracts or a compromise of Ethereum, Aave, Kelp DAO or the rsETH token contract.
Kelp temporarily placed the receiving address under a 24-hour wallet-level pause. It said rsETH remains fully backed and that minting, withdrawals and integrations continued normally. For crypto traders, the incident raises short-term concerns about Safe wallet security, custom DeFi modules, liquidity and MEV execution. However, it does not currently indicate a protocol-wide failure or a loss of rsETH backing.
Neutral
The direct price impact on ETH and rsETH is likely to be limited because the incident was isolated to a custom Safe wallet module and a malicious Uniswap v4 hook. Safe’s core contracts, Kelp’s rsETH backing and related protocol operations were not reported to be compromised. This reduces the likelihood of sustained selling pressure or a broader liquidity crisis.
In the short term, traders may apply a security and counterparty-risk discount to rsETH-linked markets and other assets using custom Safe modules. MEV activity could also increase volatility around similar transactions. However, the temporary wallet-level pause and continued Kelp operations should help contain contagion. Over the longer term, the exploit may encourage stricter audits and reduced adoption of unaudited modules and DeFi hooks, but it does not currently provide a strong fundamental catalyst for a sustained rise or fall in ETH or rsETH prices.