Blockchain security firms Blockaid, PeckShield, and BlockSec have confirmed an exploit that drained approximately $7.8 million worth rsETH — around 2,900 tokens — from a Gnosis Safe wallet on Ethereum. Safe is a smart-contract wallet widely used to secure large on-chain holdings, and rsETH is the liquid restaking token issued by KelpDAO, a tradable representation of restaked assets. According to the firms' reports, the incident began at 04: UTC on September 15 with a transaction that moved the bulk of the funds, followed by several smaller transactions over the next hour totaling an additional ~$160,000.

Flawed Authorization Check Allowed Arbitrary Execution

The root cause was a flawed authorization check in the executor contract, identified by analysts as address 0x4f0055926c839D1d960a82CBF84E2eE933958ebC. The targeted Safe, which belonged to a large holder of leveraged rsETH, relied on a whitelisted strategy executor module that exposed a recipe entrypoint. This entrypoint forwarded fully caller-supplied calldata into the Safe's execTransactionFromModuleReturnData function using operation=1 (DELEGATECALL) — an operation that allows the called code to run within the caller's own context — without gating the external caller. Setting the supplied contract parameter to the executor's own address passed validation, meaning anyone who could reach the entrypoint could execute arbitrary code inside the Safe, effectively gaining full control over its assets.

The attacker used a public keeper multicall to route the authorized Uni V4 LP Safe module into an attacker-created hooked Uniswap V4 pool, executing via Permit2 and the PositionManager. As part of the setup, the attacker deployed a worthless token dubbed the “Permissionless Attacker Token” (PAT) and supplied roughly 2,900 aEthrsETH as liquidity against it. A custom hook in the pool then unwrapped the aEthrsETH into rsETH and siphoned it out of the Safe, which was left holding a valueless LP NFT.

Blockaid exploit detection system detected an exploit on an unidentified user's Safe on Ethereum. ~$7.73M confirmed rsETH loss so far. An attacker used a public keeper multicall to drive a custom Uni V4 LP Safe module into an attacker-created hooked pool; the hook unwrapped…

— Blockaid (@blockaid_) September 15, 2026

MEV Bot Front-Runs Attack; KelpDAO Imposes Temporary Pause

Notably, the original attack transaction never reached its intended beneficiary. The attacker launched the exploit directly into the public mempool, where it was front-run by an MEV bot named “yoink,” which captured the entire ~2,882 rsETH — worth roughly $7.8 million — and routed it to address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0. In effect, a maximal extractable value bot — a program that captures value by exploiting the ordering of transactions within a block — rather than the attacker, walked away with the stolen funds.

In response, KelpDAO announced that it had detected suspicious activity on the receiving address and placed it under a precautionary 24-hour pause, during which rsETH cannot move in or out. The team stated it is working with security experts on the investigation and emphasized that the measure is wallet-level only: Kelp contracts remain safe, rsETH stays fully backed, and all minting, withdrawal, and integration operations continue normally, with no action required from users.

We've detected potential suspicious activity on an the address (0xc70f00cd7e461686b04b0e912e309becA8b80ea0) that received rsETH a few hours ago. Out of an abundance of caution, we've placed that address under a temporary 24-hour pause. During this window, rsETH cannot move in…

— Kelp (@KelpDAO) September 15, 2026

Module-Level Abuse, Not a Safe Core Vulnerability

Security analysts stressed that this was module-authorization abuse specific to one Safe, not a vulnerability in Safe's core contracts or owner keys. Because Safe modules execute with the wallet's own authority, a flaw in even a trusted, whitelisted extension can expose an entire balance without any compromise of owner controls. The incident nonetheless highlights a persistent risk for smart contract wallet users: Safe's core has never suffered a direct protocol exploit, but users have repeatedly lost funds through compromised infrastructure and vulnerable third-party extensions, including over $2 million stolen in address-poisoning attacks affecting 21 Safe users in 2023.

Source: Metaverse Post