A Safe wallet lost approximately 2,900 rsETH—valued at about $7.73 million—in a transaction involving a malicious Uniswap v4 hook route at 04:38:47 UTC on Sept. 15.
The transaction removed the assets from wallet 0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8, according to the wallet record on Etherscan. In the same block, an MEV bot known as Yoink front-ran the exploit and captured the extracted rsETH, according to a reconstruction reported by Cointelegraph.
The assets were intercepted during the exploit’s execution rather than remaining with the apparent exploit route.
Malicious hook route removes rsETH from Safe wallet
The incident centered on a malicious Uniswap v4 hook route using custom logic around a liquidity pool. The on-chain record identifies roughly 2,900 rsETH removed at 04:38:47 UTC on Sept. 15.
Available reporting does not describe a reported compromise of Safe’s core contracts, instead placing the event in the configuration and execution path of a custom module attached to the affected Safe wallet.
Blockaid traces custom liquidity module route
Blockaid’s reconstruction indicated that a public keeper multicall routed an authorized custom Uniswap v4 liquidity module attached to the Safe into an attacker-created hooked pool. The route converted aEthrsETH into transferable rsETH, according to the report, which Yoink captured after intervening in the same block.
That account places the event in the Safe’s authorized module and hooked-pool execution path, rather than describing a reported compromise of Safe’s core contracts.
KelpDAO statement announcing a temporary pause on the address that received the extracted rsETH. — Source: Cointelegraph / KelpDAO
KelpDAO pauses receiving address for 24 hours
KelpDAO said on Sept. 15 that it had placed receiving address 0xc70f00cd7e461686b04b0e912e309beca8b80ea0 under a temporary 24-hour pause. In the same statement, the protocol said its contracts remained safe and rsETH was fully backed.
The address-specific pause is the concrete containment step disclosed following the transaction. KelpDAO’s statement did not, in the supplied material, set out any further recovery process or broader timetable beyond the 24-hour measure.
