Custom Safe Module Exploit Leads to Loss
An Ethereum wallet holding leveraged rsETH lost approximately $7.8 million on September 15, 2026, after an attacker exploited a custom Safe module linked to a Uniswap v4 liquidity pool. Security firm Blockaid traced the incident to a Gnosis Safe wallet holding about $7.73 million worth of rsETH prior to the attack.
According to security analysis, the custom Uniswap v4 LP Safe module featured a public entry point that accepted caller-controlled data and used DELEGATECALL without proper access checks. Because the module was authorized by the Safe, an outside attacker utilized the entry point to execute code within the wallet's context, gaining control over the assets.
Attack Vector and MEV Front-Running
The attacker leveraged a public keeper multicall function to direct the custom Safe module toward a malicious hooked pool. The module then unpacked the wallet's aEthrsETH into raw rsETH. However, the original attacker did not retain the stolen funds because an MEV bot named "yoink" detected the transaction in the Ethereum mempool, front-ran it, and captured the entire roughly $7.8 million in rsETH.
Security researchers noted that because rsETH functions as a liquid restaking token, recovery depends on whether the token's design permits freezing, blacklisting, or restricting assets held by the address controlled by the bot.
Kelp DAO Response
In response to the incident, the Kelp DAO team temporarily paused rsETH transfers for 24 hours to isolate funds associated with an address that received the tokens. The team emphasized that its core smart contracts remain secure, the rsETH pool is fully collateralized, and normal minting, redemptions, and other decentralized finance integrations continue to operate.
