TL;DR
- An attacker drained 2,900 rsETH worth approximately $7.8 million from a Gnosis Safe wallet on the Ethereum network.
- They exploited a bug in an auxiliary contract authorized by the victim, not in Safe’s core contracts, according to BlockSec, Blockaid and SlowMist.
- An automated bot called “yoink” front-ran the attack transaction and captured the tokens, sending 2,882 rsETH to a separate address.
A bug in an auxiliary contract enabled the draining of a Gnosis Safe wallet for an amount equivalent to $7.8 million in rsETH, the liquid staking token issued by Kelp DAO.
The incident occurred early Tuesday on the Ethereum network and was detected by security firms BlockSec, Blockaid and SlowMist, which traced the origin of the flaw to an external component that the victim themselves had authorized.
ALERT! Our system detected an attack that drained ~$7.8M from a Gnosis Safe wallet on Ethereum (0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8).
The root cause was a flawed authorization check in the executor contract (0x4f0055926c839D1d960a82CBF84E2eE933958ebC). Setting the supplied… pic.twitter.com/LGb5T2cAOC— BlockSec Phalcon (@Phalcon_xyz) September 15, 2026
The affected wallet was configured to allow an auxiliary contract to execute fund movements in an automated manner, a common practice among those running automated trading strategies. However, the contract had a defective permission check: instead of confirming that the caller had actual authorization, the system approved any request that named the auxiliary contract itself as the destination.
🚨Blockaid exploit detection system detected an exploit on an unidentified user's Safe on Ethereum.
~$7.73M confirmed rsETH loss so far.
An attacker used a public keeper multicall to drive a custom Uni V4 LP Safe module into an attacker-created hooked pool; the hook unwrapped…— Blockaid (@blockaid_) September 15, 2026
Safe Did Not Fail: the Problem Was in the Contract Chosen by the User
The firm AstraSec analyzed the attack: “The root cause was a defective authorization check in the Multicall contract“. Both BlockSec and SlowMist agreed that the flaw did not belong to the core contracts of Safe, but to an external component chosen and enabled by the wallet owner themselves.
🚨SlowMist TI Alert🚨
đź’¸ Unknown Gnosis Safe wallet Loss: ~$7.73M
🔍 Root Cause: In the `multicall(address, bytes[])` function of the Router contract (address `0x4f005592…`), the `_contract` parameter could be set to `address(this)`. Consequently, the `_isAuthorized`…
— SlowMist (@SlowMist_Team) September 15, 2026
The attacker dumped the approximately 2,900 rsETH into a liquidity pool built minutes earlier around a worthless token called Permissionless Attacker Token, leaving the victim with a receipt worth nothing. However, an automated bot identified as “yoink” front-ran the transaction using a front-running technique, paying around $47,000 to jump the queue and capture the tokens before the original attacker. The bot sent 2,882 rsETH to a separate address.
Kelp DAO, issuer of the rsETH token, clarified that its contracts remain secure and that the asset remains fully collateralized. As a preventive measure, the platform announced a temporary 24-hour pause on the address that received the compromised rsETH, during which the token cannot enter or leave that address.
