On September 15, an unknown attacker targeted a Safe wallet on the Ethereum network, initiating the withdrawal of approximately 2900 rsETH, valued at around $7.73 million. The transaction was detected by the MEV bot Yoink, which executed its own operation before the attacker and seized the assets, according to Blockaid specialists.
🚨Blockaid exploit detection system detected an exploit on an unidentified user’s Safe on Ethereum.
~$7.73M confirmed rsETH loss so far.
An attacker used a public keeper multicall to drive a custom Uni V4 LP Safe module into an attacker-created hooked pool; the hook unwrapped…— Blockaid (@blockaid_) September 15, 2026
According to the company, the attacker used a public Multicall invocation, designed for automatic operations, to redirect a user-connected Uniswap v4 liquidity module to a pool created with a malicious smart contract.
This contract unwrapped aEthrsETH back into rsETH, after which Yoink extracted the assets in the same block using MEV. One of the transactions can be tracked via Etherscan.
Where the Error Occurred
Experts from BlockSec and SlowMist linked the incident to an authorization check error in an auxiliary Multicall contract, which the wallet owner had previously authorized. Due to incorrect parameter checks, an external user could gain authorization and initiate operations through the trusted component.
AstraSec also identified the flawed authorization check in the Multicall contract as the cause of the incident.
🚨~$7.8M Gnosis Safe Drain via Flawed Multicall Authorization Check
Root Cause
The root cause was a flawed authorization check in the Multicall contract. Setting the ‘target’ parameter to address(this) caused the inner ‘multicall’ to pass the validation because msg.sender… pic.twitter.com/IS6L6ixBqk— AstraSec (@AstraSecAI) September 15, 2026
Researchers concluded that the issue did not affect the core Safe smart contracts. The vulnerability was in an additional component connected by the specific wallet owner.
Kelp Temporarily Restricts Operations for Address
The Kelp DAO protocol, which issues rsETH, detected suspicious activity on one of the addresses that received tokens and temporarily restricted operations for 24 hours.
We’ve detected potential suspicious activity on an the address (0xc70f00cd7e461686b04b0e912e309beca8b80ea0) that received rsETH a few hours ago.
Out of an abundance of caution, we’ve placed that address under a temporary 24-hour pause. During this window, rsETH cannot move in…
— Kelp (@KelpDAO) September 15, 2026
Kelp emphasized that the restriction applies only to one address. The protocol’s smart contracts remain unaffected, rsETH is fully backed, and issuance, withdrawals, and integrations continue to operate normally. Users do not need to take any additional actions.
In February 2025, a vulnerability in the Safe infrastructure was cited as the main cause of the Bybit crypto exchange hack.
