An Ethereum smart contract wallet lost approximately 2,900 rsETH, valued at around $7.8 million, on the morning of September 15, 2026, after a custom liquidity provider module attached to the wallet was routed through an attacker-controlled Uniswap v4 pool. The original exploit transaction was broadcast to the public mempool and did not settle to the attacker.
A generalized Maximal Extractable Value (MEV) searcher publicly tagged as “Yoink” executed first in the same Ethereum block, captured the position, and moved the bulk of the tokens to a new receiving address.
Kelp DAO, the issuer of the restaked Ether (rsETH) token involved, responded within hours by placing a 24-hour wallet-level pause on that receiving address, while stating that its core contracts and rsETH backing remained unaffected and that standard user operations were continuing as usual.
Victim Safe and the position that was drained
The victim wallet, 0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8, is a Gnosis Safe (a widely used smart contract wallet architecture that lets multiple owners collectively control funds through configurable signing thresholds) running the Safe Singleton implementation, version 1.3.0. It held a leveraged rsETH position on Aave V3, a decentralised lending protocol on Ethereum, in the form of aEthrsETH, which is the interest-bearing wrapper Aave issues to depositors of rsETH.
According to on-chain data, the position was drawn down in a single transaction that burned about 2,899.999999999997756819 aEthrsETH and withdrew the same quantity of rsETH from Aave. Security firm Blockaid, which flagged the incident first, placed confirmed losses at about $7.73 million. Security firm PeckShieldAlert independently pegged the front-run size at roughly $7.81 million.
Reconstructed call path
Blockaid reconstructed the call path as running from a public keeper address (0x4f005592…) through a helper contract (0xeA18B13d…) into the Safe’s execTransactionFromModuleReturnData function. From there, execution moved through a custom Uniswap v4 liquidity provider module at 0xDcDc4ef8…, and then through Permit2 (Uniswap’s shared token approval router) and the Uniswap v4 PositionManager.
The attacker then supplied liquidity into a Uniswap v4 pool that carried an attacker-controlled hook, and that hook unwrapped the aEthrsETH into freely transferable rsETH, at which point the tokens left the Safe.
Blockaid described the event as “module-authorization abuse on that Safe, not a Safe core / owner-key bug”. DeFi security monitor Defimon Alerts published a matching technical note, stating that the leveraged rsETH position sat behind a whitelisted strategy-executor module.
According to that reconstruction, the module exposed a recipe entrypoint that forwarded fully caller-supplied calldata into the Safe’s execTransactionFromModuleReturnData function with the operation flag set to 1 (a DELEGATECALL) and did not gate the external caller.
Because the module was already an authorized Safe module, any caller able to reach that entrypoint could execute arbitrary code inside the Safe’s own execution context, which means the Safe’s signature threshold and its owner set were not required to sign the movement of funds.
On-chain researchers have since discussed a possible link between the module pattern and a MakinaFi-style architecture, and one address referenced in follow-up posts is 0xC62d6FDC4e77C4d006784bc4805703b37fFCc4b7. That attribution is currently circulating among monitoring accounts and has not been recorded as a formal vendor statement in the primary alerts.
In-block capture by Yoink
The Yoink bot’s execution is recorded in the primary extraction transaction, which was included at 04:38:47 UTC in block 25980525. The originating externally owned account at 0xFDe0d1575Ed8E06FBf36256bcdfA1F359281455A, labeled MEV Frontrunner Yoink on Etherscan, called through the Yoink bot contract at 0x80BF7Db69556D9521c03461978B8fC731DBBD4e4.
A helper contract at 0x10605eE48Ff962952C966277A5D2dac0A0705Cb1 sat in the token flow. Etherscan priced the leg at $7,848,604.81.
Following the extraction, the bot sent 2,882.37 rsETH, valued at $7,800,883.70, to 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, and swapped the remaining 17.63 rsETH, valued at $47,721.12, through the Uniswap v4 Pool Manager.
Blockaid’s initial alert listed three exploiter-linked addresses: 0x0dC2c5D6b05A317076CF501f7E7be36A5dfe9b66, 0x10605eE48Ff962952C966277A5D2dac0A0705Cb1, and 0xC70f00CD7E461686b04B0E912E309becA8b80ea0. The rsETH token contract address is 0xa1290d69c65a6fe4df752f95823fae25cb99e5a7.
The Yoink identifier has appeared in prior on-chain reporting on airdrop and claim-contract front-running, and Etherscan’s public label on the EOA reflects that history rather than any statement from the operator behind it.
Follow-on transactions across the morning
Blockaid’s update thread lists a series of smaller transfers timed across the same morning. At 05:24 UTC, roughly $134,000 (about 50 rsETH) was recorded. At 05:43 UTC, roughly $24,000 moved. Three transfers of about $1,300 each followed at 05:49 UTC, 05:54 UTC, and 05:54 UTC.
A later Yoink transaction at 05:53:59 UTC in block 25980901 records another Aave unwrap of 157.71 rsETH, valued at $426,820.96, into the same bot. According to the transaction trace, the bot then routed 157.707108663118059797 rsETH through Fluid Dex, a decentralised exchange venue, in exchange for 169.833880906699 ETH.
On-chain researchers, including BlockWatchdog, have noted that the 2,900 rsETH slice may correspond to liquidation headroom on a larger Aave rsETH loop, that subsequent flows brought the position’s health factor down toward 1.00, and that a liquidation leg was closed on top of that structure.
The same reconstruction suggests that a second Safe drained near 05:47 UTC produced a realised value closer to $129,000. These figures are drawn from independent researcher commentary and have not been recorded in an official post-mortem from any of the affected protocols.
Kelp DAO’s wallet-level pause
At 06:03 UTC, Kelp DAO posted that it had detected potential suspicious activity on the address 0xc70f00cd7e461686b04b0e912e309beca8b80ea0, which received the majority of the rsETH from the earlier Yoink transaction.
In its statement, Kelp said: “We’ve detected potential suspicious activity on an the address (0xc70f00cd7e461686b04b0e912e309beca8b80ea0) that received rsETH a few hours ago. Out of an abundance of caution, we’ve placed that address under a temporary 24-hour pause. During this window, rsETH cannot move in or out of it. We’re working closely with security experts to investigate and resolve this as quickly as possible.”
They added, “This is a precautionary, wallet-level measure only. Kelp contracts are safe, rsETH remains fully backed, and all operations – minting, withdrawals, and integrations – are running normally. No user action is required. We’ll share a full update once the review concludes.”
PeckShieldAlert separately noted that the funds “currently sit in 0xC70f00CD…80ea0.” No public on-chain message has been posted from Yoink’s operator at the time of writing. The 2,882 rsETH parked at the paused receiver is the portion isolated within Kelp’s 24-hour window. The 17.63 rsETH already sold on Uniswap v4, together with the 157.71 rsETH later routed through Fluid Dex, sit outside that freeze.
Separate from the April bridge incident
The September 15 event is a user-wallet loss and is distinct from Kelp DAO’s April 18 bridge incident, in which 116,500 unbacked rsETH were minted through a forged LayerZero message.
Kelp and Aave later restored rsETH operations through a coordinated backing exercise, with follow-up work covering full backing restoration even as related civil proceedings continued. That April case is separate. Do not treat the 2026 laundering reports on the April exploiter wallet as part of this Safe drain.
What is documented and what remains open
Based on the alerts and on-chain records available at the time of writing, the documented elements of the September 15 event include the following. A user-controlled Safe was drained through an authorised custom module. The aEthrsETH position was unwrapped to rsETH through a Uniswap v4 pool carrying an attacker-controlled hook.
The Yoink bot captured the main 2,900 rsETH print in the same block as the original exploit transaction. Kelp DAO placed a 24-hour pause on the wallet that received the tokens. Protocol-level rsETH backing was not identified in the alerts as the failure mode.
The elements that remain open include the formal identification of the Safe owner, any formal statement from a named module vendor, any public message from Yoink’s operator concerning the destination of the funds, and a consolidated official loss figure that accounts for the follow-on transactions and any related liquidations.
The near-term point of attention is Kelp’s 24-hour pause on 0xC70f00CD…80ea0, which is the only official containment measure recorded so far. If the pause holds through the review window, the 2,882 rsETH parked at the receiver remains the portion in a restricted state, while the value already routed through Uniswap v4 and Fluid Dex sits outside protocol-level control.
Also Read: Chainflip Halts Network After $736K Tron USDT Exploit; Users to Be Made Whole
