MEV Bot Intercepts $7.7M rsETH Safe Wallet Exploit
An attempted $7.7 million rsETH exploit involving an Ethereum Safe wallet was intercepted by the MEV bot Yoink. Blockaid said the attacker abused an over-permissioned custom Uniswap v4 liquidity module and a public keeper multicall, directing the Safe to an attacker-controlled hooked pool. The attacker sought to convert aEthrsETH into rsETH and withdraw the funds.
The targeted Safe held about $7.73 million in rsETH. Yoink detected the exploit in the public mempool, paid about $46,000, or 18.93 ETH, to a block-builder address, and ordered its transaction first. The bot captured about 2,882 rsETH before the attacker could take control. The final distribution of the recovered funds remains unclear.
Kelp then applied a 24-hour wallet-level pause to the receiving address. It said rsETH remained fully backed and that minting, withdrawals and integrations continued normally. Blockaid and Kelp said the incident involved custom Safe modules, smart-contract permissions and MEV activity, rather than a compromise of Safe’s core contracts, owner keys or Kelp’s core protocol. For traders, the event highlights ongoing DeFi security and third-party module risks, while the limited direct impact on rsETH’s backing and operations is likely to reduce sustained selling pressure.
Neutral
The direct price impact on rsETH is likely neutral. The attempted exploit was intercepted, and Kelp said rsETH remained fully backed while minting, withdrawals and integrations continued normally. This limits the risk of a redemption-driven sell-off or a loss of confidence in the token’s underlying reserves.
In the short term, traders may still apply a modest risk discount because the incident exposes vulnerabilities in custom Safe modules, permission systems and DeFi infrastructure. Volatility could increase if the recovered funds are disputed, redistributed or linked to further exploit activity. However, there is no reported compromise of Kelp’s core contracts, so sustained bearish pressure on rsETH appears limited.
Over the longer term, the event may encourage tighter module audits, stricter permissions and greater monitoring of MEV transactions. Those measures could improve confidence, although repeated incidents involving third-party infrastructure may continue to weigh on the broader perception of liquid-restaking and DeFi tokens.