MEV Bot Seizes $7.7M rsETH After Ethereum Safe Exploit

An attempt to steal about $7.73 million in rsETH from an Ethereum Safe was intercepted when an MEV bot front‑ran the exploiter and captured the tokens. The protocol behind rsETH, Kelp, placed the address that received the funds under a 24‑hour pause.

Blockchain security firm Blockaid reported the incident and traced the exploit to a custom module connected to the victim’s Safe wallet. The attacker used a public keeper multicall to route a Uniswap v4 liquidity module into an attacker‑created pool, where wrapped staking tokens were unwrapped into rsETH. Blockaid identified the affected wallet as a Safe owned by an unidentified user and initially estimated the amount involved at roughly $7.73 million in rsETH.

Before the attacker completed a withdrawal, an automated MEV (maximal extractable value) bot known as Yoink monitored the pending transaction and submitted a competing transaction with higher priority. That bot captured the rsETH and redirected funds. On‑chain records show Yoink moved about 18.93 ETH, roughly $46,000, to an address labeled as a block builder within the same transaction.

Kelp placed the receiving address on a 24‑hour pause to prevent immediate transfers. Kelp described the pause as “a precautionary, wallet‑level measure only” and added that “Kelp contracts are safe, rsETH remains fully backed.” The protocol reported that minting, withdrawals and existing integrations continued to operate normally while security specialists investigate the flow of funds.

Blockaid’s technical account says the attacker combined a public keeper multicall with a custom Uniswap v4 liquidity module to route liquidity into a hooked pool they controlled, enabling conversion of wrapped staking assets into rsETH and creating a window to extract value.

MEV bots like Yoink scan pending transactions and try to capture profitable flows by submitting faster or higher‑fee transactions. In this case, the bot appears to have outpaced the original exploiter and moved the rsETH to an address Kelp then flagged and temporarily froze.

Kelp is coordinating with security experts to trace the funds and explore recovery options. The Safe wallet remains linked to an unidentified user. Neither Blockaid nor Kelp has published a full timeline of the initial exploit and the subsequent MEV intervention as of the latest update.

Ethereum Safe wallets allow owners to install custom modules that automate or extend wallet functions. Those modules can enable advanced operations but also introduce risk when they are misconfigured or connect to unverified contracts. rsETH is a staking derivative managed by Kelp; wrapped staking tokens can be converted into rsETH as part of liquidity actions.