Security experts linked the $7.8 million theft to a helper contract authorized by the wallet owner, rather than to Safe itself.
By Oliver Knight|Edited by Jamie Crawley4 hrs ago1 min readMake preferred on ShareShare this articleCopy linkX (Twitter)LinkedInFacebookEmailMake preferred on Gnosis wallet hacked (Kevin Horvat on Unsplash)SummaryShow- A hacker stole approximately 2,900 rsETH, valued at around $7.8 million, from a Gnosis Safe wallet on Ethereum early Tuesday.
- A trading bot named yoink detected the attack in the public transaction queue, paid roughly $47,000 to prioritize its processing, and seized the tokens.
- Security firms SlowMist and BlockSec traced the issue to a helper contract that the wallet owner had authorized, which mistakenly approved any caller that referenced the contract itself.
An attacker successfully targeted a Gnosis Safe wallet on Ethereum, absconding with about 2,900 rsETH, equating to roughly $7.8 million, on Tuesday.
The automated bot “yoink” managed to front-run the attack transaction, thereby extracting the tokens, according to security firms including BlockSec, Blockaid, and SlowMist.
The compromised wallet was configured to permit a helper contract to transfer funds, a common practice among users who automate trading. However, the intended verification process failed, as SlowMist and BlockSec discovered that the authorization check mistakenly accepted requests from anyone naming the helper as the target.
The hacker subsequently laundered about 2,900 rsETH into a newly created trading pool associated with a worthless token called Permissionless Attacker Token, leaving the wallet with a receipt of no value. The yoink bot paid around $47,000 to jump the transaction queue and acquired the tokens, forwarding 2,882 rsETH to another address.
AstraSec noted on X that “the root cause was a flawed authorization check in the Multicall contract.” Other security experts concurred that the issue stemmed from a component that the wallet owner had trusted, rather than from Safe's fundamental contracts. Kelp DAO, the issuer of rsETH, affirmed that its contracts are secure and that rsETH is fully collateralized.
KelpDAO also reported suspicious activity concerning an address that received rsETH shortly after the incident, stating, “As a precaution, we have temporarily paused that address for 24 hours, preventing any movement of rsETH in or out.”
HackEthereum NewsLatest Crypto News- 1European Central Bank calls for merchants to participate in digital euro pilot48 min ago
- 2Clarity Act's odds of passing plunge as Republicans reject Democrats' counter-proposal49 min ago
- 3A hacker turned 25 cents of bitcoin into 46 billion fake BTC tokens on a DeFi bridge1 hr ago
- 4Standard Chartered predicts Arbitrum's ARB to rise 70-fold to $10, citing Robinhood Chain revenue1 hr ago
- 5To ensure permanent economic innovation, we must pass the Clarity Act now3 hrs ago
- 6Ether, solana, XRP likely to gain if Clarity Act progresses3 hrs ago
- 7Why banks should stop worrying and learn to love the Clarity Act4 hrs ago
- 8Velocity extends Series A to $48M at $200M valuation with backing from Visa, Circle, and Ripple4 hrs ago
- 9Bitcoin gives back Monday's gain as Clarity Act odds fade on Polymarket4 hrs ago
- 10Nigel Farage-backed Stack BTC plans to acquire a gold dealer for $16 million to fund bitcoin buy4 hrs ago
Tokenized Equities Lead RWA Inflows as bStocks Sets the Pace
Tokenized Equities Lead RWA Inflows as bStocks Sets the Pace
Tokenized equities lead RWA inflows as the market recovers; Binance's bStocks hit ~$118.5M in two months, now #2 issuer and ~90% of on-chain equity DEX volume.
By CoinDesk ResearchAug 27, 2026Tokenized equities lead RWA inflows as the market recovers; Binance's bStocks hit ~$118.5M in two months, now #2 issuer and ~90% of on-chain equity DEX volume.
Why it matters:
Tokenized equities lead RWA inflows as the market recovers; Binance's bStocks hit ~$118.5M in two months, now #2 issuer and ~90% of on-chain equity DEX volume.
View Full ReportMore From Finance