A hacker exploited a coding error to steal $7.8 million from a Gnosis Safe wallet, but an automated bot managed to recover most of the funds.
A hacker managed to steal approximately 2,900 rsETH, valued at around $7.8 million, from a Gnosis Safe wallet on Ethereum early Tuesday.
The attack was detected by an automated trading bot named "yoink," which expedited the transaction for about $47,000, allowing it to secure the stolen tokens ahead of the hacker.
According to security firms SlowMist and BlockSec, the theft was traced back to a helper contract that the wallet owner had authorized. This contract was supposed to facilitate fund transfers but had a critical flaw in its authorization check, permitting any caller referencing the contract to execute transactions.
After the theft, the hacker laundered the stolen rsETH into a new trading pool linked to a token dubbed the Permissionless Attacker Token, resulting in a worthless receipt for the wallet. The yoink bot subsequently transferred 2,882 rsETH to another address.
AstraSec highlighted the issue as stemming from a flawed authorization within the Multicall contract. Other experts confirmed that the vulnerability arose from the trusted component rather than the core Safe contracts. Kelp DAO, the issuer of rsETH, reassured that their contracts remain secure and fully collateralized.
In response to the incident, KelpDAO temporarily paused an address that received rsETH shortly after the hack, preventing any further transactions to or from that address for 24 hours.
