Coding Flaw in Helper Contract Lets MEV Bot Capture $7.8M rsETH From Gnosis Safe

What happened: On September 15, 2026, a Gnosis Safe wallet using a custom Uniswap v4 liquidity module lost ~2,900 rsETH (about $7.8 million) due to a faulty authorization check in a Multicall helper contract. An attacker exploited the flaw to siphon funds, but a MEV bot named "yoink" front-ran the transaction, paying ~$47,000 in gas fees and capturing nearly all the rsETH before the attacker could. The funds now sit with the MEV bot, not the original attacker. Kelp DAO, issuer of rsETH, imposed a 24-hour freeze on the receiving address and confirmed the core protocol was unaffected.

Why it matters: The incident highlights the risks of integrating custom modules into otherwise secure wallet systems. Security researchers stressed the vulnerability was not in Gnosis Safe itself, but in user-added code. The fact that an MEV bot, not the attacker, ended up with the funds adds a unique twist, raising questions about the ethical and practical implications of MEV in DeFi exploits. This event is distinct from the much larger $292M Kelp DAO exploit in April 2026.

Source: CoinDesk