On September 15, a mysterious attacker targeted a Safe wallet within the Ethereum network, attempting to withdraw approximately 2,900 rsETH valued at around $7.73 million. The transaction was detected by the MEV bot Yoink, which executed its own operation ahead of the attacker, successfully seizing the assets, as reported by Blockaid specialists.

šŸšØBlockaid exploit detection system detected an exploit on an unidentified user's Safe on Ethereum.
~$7.73M confirmed rsETH loss so far.
An attacker used a public keeper multicall to drive a custom Uni V4 LP Safe module into an attacker-created hooked pool; the hook unwrappedā€¦

ā€” Blockaid (@blockaid_) September 15, 2026

According to the firm, the attacker exploited a public Multicall function that is designed for automating operations. This was used to reroute a user-defined Uniswap v4 liquidity module connected to the Safe into a pool they had created with a malicious smart contract.

This contract unwrapped aEthrsETH back into rsETH, allowing Yoink to extract the assets in the same block through MEV. One of the transactions can be tracked via Etherscan.

Identifying the Flaw

Experts from BlockSec and SlowMist linked the incident to a flaw in the authorization check within the Multicall contract, which the wallet owner had previously granted permissions to. Due to improper parameter validation, an unauthorized user could pass authentication and initiate operations through the trusted component.

AstraSec also attributed the incident to an incorrect authorization check in the Multicall contract.

šŸšØ~$7.8M Gnosis Safe Drain via Flawed Multicall Authorization Check

Root Cause
The root cause was a flawed authorization check in the Multicall contract. Setting the 'target' parameter to address(this) caused the inner 'multicall' to pass the validation because msg.senderā€¦ pic.twitter.com/IS6L6ixBqk

ā€” AstraSec (@AstraSecAI) September 15, 2026

Researchers concluded that the issue did not affect the core smart contracts of Safe. The vulnerability was associated with an auxiliary component that the wallet owner had connected.

Kelp Temporarily Restricts Operations for Address

The Kelp DAO protocol, which issues rsETH, identified suspicious activity associated with one of the addresses that received tokens and temporarily restricted operations for that address for 24 hours.

We've detected potential suspicious activity on an the address (0xc70f00cd7e461686b04b0e912e309beca8b80ea0) that received rsETH a few hours ago.

Out of an abundance of caution, we've placed that address under a temporary 24-hour pause. During this window, rsETH cannot move inā€¦

ā€” Kelp (@KelpDAO) September 15, 2026

Kelp emphasized that the restriction applies only to one address. The protocol's smart contracts remain unaffected, rsETH is fully backed, and issuance, withdrawals, and integrations continue to function as normal. No additional actions are required from users.

It is worth noting that in February 2025, a vulnerability in the Safe infrastructure was cited as a primary reason for the hack of the cryptocurrency exchange Bybit.