Yoink MEV bot front-runs $7.8M rsETH Safe-module drain as Kelp pauses receiver
By Crypto Wire
September 17, 2026
An attacker tried to drain about 2,900 rsETH—roughly $7.8 million—from an Ethereum Gnosis Safe early on Tuesday, September 15, 2026, then lost the payout in the same block to an MEV bot tagged Yoink, according to CoinDesk’s September 15 report citing security firms SlowMist, BlockSec, Blockaid, and others. For NFT and crypto collectors who bolt automation modules onto Safes, that is a recovery-room lesson: the failure path was a helper contract the wallet trusted, not a break of Safe’s core contracts.
CoinDesk said the victim wallet had authorized a helper contract to move funds—an ordinary setup for automated trading. The helper was supposed to verify caller permission, but SlowMist and BlockSec found the check approved anyone who named the helper itself as the target. AstraSec, also cited in the coverage, called the root cause a flawed authorization check in a Multicall contract. Security firms agreed the failure sat in a component the owner chose to trust, not in Safe’s core. The attacker then dumped around 2,900 rsETH into a trading pool built minutes earlier around a worthless token labeled Permissionless Attacker Token, leaving the wallet with a receipt worth nothing.
Yoink’s bot paid roughly $47,000 to jump the public queue, took the tokens, and sent about 2,882 rsETH to a separate address, per CoinDesk. Cointelegraph’s September 15 wrap similarly said Blockaid flagged about $7.73 million in confirmed rsETH loss from an unidentified user’s Safe and that Yoink front-ran the exploit transaction, transferring about 18.93 ETH (roughly $46,000) to a block-builder address in the same transaction. The original exploit broadcast sat in the public mempool, which is why a generalized MEV searcher could race it.
Kelp DAO, which issues rsETH, placed the receiving address under a temporary 24-hour pause after detecting suspicious activity, CoinDesk and Cointelegraph both reported. Kelp’s statement, as carried in those reports, said the measure was wallet-level only, that Kelp contracts were safe, that rsETH remained fully backed, and that minting, withdrawals, and integrations were running normally with no user action required. That distinction matters for collectors who confuse a restaking token sitting in a drained Safe with a protocol-wide insolvency event. The desk file still attributes the pause and backing claim to Kelp’s public response as quoted by the outlets—not to an independent audit reprint in this article.
Rug Room readers should map the pattern onto NFT custody habits. Over-permissioned marketplace approvals, operator modules, and “helper” contracts that can move inventory without a fresh signature are the same class of risk as this Safe module failure. 8bitcrypto already covers approval drainers, leaked-key insider failures, and bridge-hack recovery lessons; Tuesday’s rsETH case adds a concrete dollar print and a same-block MEV twist. Do not invent a Safe core CVE. Attribute the helper-authorization bug, the roughly $7.8 million / 2,900 rsETH figures, Yoink’s front-run, and Kelp’s pause to CoinDesk, Cointelegraph, and the named security firms those stories cite.
What the September 15 file proves is narrow and checkable. A custom trusted module enabled a drain path. An MEV bot captured most of the tokens before the original attacker settled. Kelp paused the receiving address while asserting protocol-level rsETH backing. What it does not prove is that every Safe is unsafe, that rsETH’s collateral model failed, or that Yoink will return funds under a whitehat bounty. Unchained and other secondary desks noted whitehat return precedents in other MEV cases; treat those as context, not a confirmed outcome for this wallet.
For 8bitcrypto readers on September 17, the clean recovery-room line is to audit every module and helper that can move NFT or token balances without a fresh owner signature, revoke stale marketplace approvals, and separate protocol statements from a single Safe’s operational mistake. Watch Kelp’s follow-up after the pause window and whether the receiving address remains frozen before marking the recovery closed.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
