Crypto
The 7.7 Million Dollar Heist That Got Stolen From the Thief
On September 15, somebody executed a near perfect exploit against an Ethereum wallet holding about 7.7 million dollars in rsETH, and the prize went to someone else, because an automated predator got there first. The attacker had done everything right: found a custom module connected to the victim's Safe wallet, steered it into a trap, and unwrapped the funds. But the transaction had to cross the public mempool to reach the chain, and in the mempool, a bot named Yoink was waiting.
Blockchain security firm Blockaid reconstructed the play. The attacker used a public keeper multicall to direct a custom Uniswap v4 liquidity module into a hooked pool the attacker had created, a clever bit of plumbing that unwrapped aEthrsETH, an Aave wrapped version of restaked ETH, into raw rsETH sitting ready for extraction. The Safe belonged to an unidentified user, and Blockaid put the value at about 7.73 million dollars. On paper, it was a clean getaway.
It stayed on paper because Yoink saw the transaction before it was mined. MEV bots monitor the mempool for profitable opportunities, and this one recognized a 7.7 million dollar opportunity wearing a name tag. Yoink jumped ahead of the attacker's transaction and captured the rsETH first, then paid about 18.93 ETH, roughly 46,000 dollars, to an address labeled as the transaction sequencer in the same transaction, the standard toll for priority ordering. The thief's transaction executed into empty air.
What happened next is the part the industry should study. Kelp, the protocol behind rsETH, placed the receiving address under a pause of 24 hours, temporarily preventing the tokens from moving. The team called it a precautionary measure at the wallet level only, adding that Kelp contracts are safe and rsETH remains fully backed. Minting, withdrawals, and integrations kept running normally throughout. The vulnerability lived in the custom module attached to the victim's Safe, and Kelp's own contracts were untouched.
Step back and the incident reads like a nature documentary. Ethereum's mempool is a dark forest where every pending transaction is visible to every predator, and the fastest code wins. The attacker understood the victim's wallet; Yoink understood the attacker. Somewhere in that chain of outsmarting, the original owner is still waiting to learn whether any of the funds come home, and the identities of the attacker, the bot operator, and the sequencer all remain undisclosed.
For readers, the practical lessons are evergreen and worth repeating. Custom wallet modules are powerful tools that demand equal care: this one had a public entry point that let an outsider execute code inside the wallet's own context. Keep wallet configurations simple, review every module you authorize, and remember that on a public chain, privacy ends the moment you broadcast. The jungle rewards the prepared, and the best defense is to keep your setup simple and your attack surface small.
Sources
- Cointelegraph: MEV Bot Front-Runs $7.7M Ethereum Wallet Exploit
- TradingView: ETH wallet exploit backfires as MEV bot captures $7.7M
New to crypto? Read the crypto glossary, browse frequent questions, read our story, or explore the story archive.