The MEV Bot That Beat the Exploiter: A Forensic Review of the 2,900 rsETH Safe Drain

EXECUTIVE SUMMARY

At 04:38:47 UTC on 15 September 2026, an Ethereum transaction removed approximately 2,900 aEthrsETH from Safe wallet 0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8, withdrew the underlying rsETH from Aave, and split the proceeds. A generalized MEV searcher known as Yoink executed first, ahead of the party that prepared the exploit path.

The largest portion, 2,882.37 rsETH, went to 0xC70f00CD7E461686b04B0E912E309becA8b80ea0. Another 17.63 rsETH was sold for approximately 18.95 ETH. Kelp publicly described a temporary 24-hour address-level pause and said rsETH remained fully backed and its core contracts were unaffected.

The chain evidence supports a narrower technical conclusion than several early headlines. The failure was not a Safe core bug, a stolen owner key, or a bypass of signature verification inside Safe. The Safe had already delegated execution power to modules. A publicly callable batch executor treated a self-target as trusted, allowing an outsider to walk through an enabled gateway and liquidity module into Safe module execution without a fresh owner signature.

ATTACK PATH AND EVIDENCE BOUNDARY

The main extraction transaction is 0x0e7680b06cb8a6f86c149d9ba90d98e3d334e7b072dde03909d43fcfd98a8705 in Ethereum block 25,980,525. Bitquery reports 175 successful calls, a maximum call depth of 24, and 39 logs.

The caller path was public executor batch(self), gateway module, Safe module execution, delegate-call execution, and the enabled Uniswap v4 liquidity module. The Safe processed those module calls as designed. The authorization weakness sat in the public batch contract's target validation and in the amount of authority reachable behind that check.

The extraction used a newly created junk token, PAT, as the other side of an aEthrsETH pool. Public discussions initially described a malicious Uniswap hook. Bitquery's call-level reconstruction says the pool's hook field was the zero address and the flow used a normal Pool Manager unlock and take sequence. Until contract-level evidence establishes otherwise, “malicious hook” should be treated as an early characterization rather than a confirmed mechanism.

CONFIRMED TRANSACTION ANCHORS

The primary victim Safe is 0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8. The reported attacker EOA is 0x0dC2c5D6b05A317076CF501f7E7be36A5dfe9b66, the helper contract is 0x10605eE48Ff962952C966277A5D2dac0A0705Cb1, and the public keeper multicall is 0x4f0055926c839d1d960a82cbf84e2ee933958ebc.

The Yoink EOA, 0xFDe0d1575Ed8E06FBf36256bcdfA1F359281455A, called the Yoink bot contract at 0x80BF7Db69556D9521c03461978B8fC731DBBD4e4. The extraction burned roughly 2,900 aEthrsETH and produced the underlying rsETH. The bot parked 2,882.37 rsETH at 0xC70f00CD7E461686b04B0E912E309becA8b80ea0 and sold the remaining 17.63 rsETH through a real ETH/rsETH market.

THE 24-SECOND RACE

At 04:38:23 UTC, the helper deployed PAT and an unlocker and minted a large PAT supply. At 04:38:35, it seeded the Uniswap v4 pool. Twelve seconds later, the Yoink transaction landed at index zero in block 25,980,525. The original attacker's transaction does not appear in that block.

Within the capture transaction, the module path moved aEthrsETH from the Safe into Pool Manager, the unlocker took the aToken, and the helper withdrew the underlying rsETH from Aave. Yoink then split the proceeds between the large receiving wallet and an in-block sale.

The distinction between “front-running the attacker” and “recovering the victim's funds” matters. Yoink prevented the original exploiter from receiving the primary payout, but public chain data does not establish that the receiving wallet belongs to a white hat or that the funds were returned. Address behavior alone cannot identify the operator or its intent.

FOLLOW-ON FLOWS AND CURRENT EXPOSURE

Bitquery reports no rsETH outflow from the 2,882.37 rsETH receiving wallet at its investigation cutoff. That supports a dormant-balance finding, not an independent proof of Kelp's off-chain restriction mechanism. Kelp's public statement described a temporary pause; Bitquery did not identify an on-chain admin pause transaction.

The same morning produced several additional flows. At 05:24:47, a copycat extraction moved 50 aEthrsETH through the same PAT pattern; 40 rsETH entered CoW in four transfers and 10 rsETH moved to another address. At 05:47:59, the same reported attacker path hit a second Safe, 0x6a1fac6b3466e29421f70d6eaa91a0de0f627ea2, moving 86,632 DUSD and 38,248 USDC and producing approximately 23.69 ETH for the attacker EOA.

At 05:53:59, Yoink used a Morpho Blue WETH flash loan and Aave's liquidation function against the first Safe. Aave events recorded about 168.83 WETH of debt covered and 157.71 rsETH seized. The seized rsETH was sold on Fluid before the flash loan was repaid.

At 06:00, the owner disabled the gateway and liquidity modules used by the drain. At 06:37, the same sender repaid 248 WETH of Aave debt. At 07:20, an owner transaction disabled nine additional modules. The containment sequence therefore followed the exploit and several copycat attempts rather than preventing the first extraction.

WHAT REMAINED ON THE SAFE

The wallet was not emptied. Bitquery's post-incident snapshot reported approximately 50,279 aEthrsETH, 51,344 variable-debt WETH tokens, 7.18 native rsETH, and 18 Uniswap v4 position NFTs, including the empty PAT position. These balances are a point-in-time public-chain observation and can change.

WHAT THE CHAIN PROVES — AND WHAT IT DOES NOT

Confirmed by transaction-level public-chain analysis:

• The primary extraction occurred in block 25,980,525 through an enabled module path without a fresh Safe owner signature.

• Roughly 2,900 aEthrsETH was converted to rsETH; 2,882.37 rsETH was parked at one receiver and 17.63 rsETH was sold.

• The pool used for PAT had a zero hook address in Bitquery's reconstruction.

• Later activity included copycat drains, a second Safe loss, an Aave liquidation funded through Morpho, and module disable transactions.

• The largest rsETH balance had no observed rsETH outflow at the published cutoff.

Not established by the available evidence:

• The real-world identity or intent of the attacker, Yoink operator, or receiving wallet controller.

• Whether the 2,882.37 rsETH will be returned, retained as a bounty, or released after the reported pause.

• Whether an off-chain restriction can be mapped to a specific on-chain admin transaction.

• A complete victim-loss figure that reconciles the initial drain, copycats, the second Safe, debt repayment, and later liquidations.

CONCLUSION

This incident is a warning about delegated authority rather than multisig cryptography. Safe's owner threshold was never asked to approve the transfer because the relevant modules already possessed a route to execute for the wallet. The control that failed was the caller boundary in front of those modules.

The MEV outcome reduced the original attacker's take but did not automatically restore the victim. Investigators should keep the 2,882.37 rsETH receiver, the ETH skim wallets, the CoW route, the Fluid sale, and the second-Safe proceeds under observation. The next material update will be a return transaction, a release from the reported restriction, or a transfer into a labeled service.

METHODOLOGY AND SOURCES

This report uses Bitquery's published call-level reconstruction and public Ethereum transaction references, cross-checked against Blockaid's initial alert, Kelp's incident statement, and contemporary reporting. A new SentinelTX investigation was not executed because the account had no remaining monthly investigation slot; this report therefore does not claim SentinelTX verification.

Bitquery, “How a Safe module drained 2,900 rsETH in one block”: https://bitquery.io/investigations/rseth-safe-module-drain

Blockaid incident alert: https://x.com/blockaid_/status/2099732957803999342

Kelp incident response: https://x.com/KelpDAO/status/2099740756865159562

Primary transaction: https://etherscan.io/tx/0x0e7680b06cb8a6f86c149d9ba90d98e3d334e7b072dde03909d43fcfd98a8705

Unchained, “A Bot Robbed the Hacker Who Drained $7.8 Million in rsETH From a Safe Wallet”: https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/