Yoink, an Ethereum MEV bot, has front-runned a Safe wallet attack involving approximately $7.8 Million in rsETH and nearly 19 ETH.
You can read more about it here:
- Yoink was able to receive 2,900 rsETH prior to the original transaction being reverted on the same Ethereum block.
- The bot routed 17,63 rsETH via Uniswap v4 and transferred 2,882.37 rsETH.
- BlockSec tracked the exploit down to weak authorisation checks in an executor agreement linked to a safe module.
- Blockaid stated that the public call multi-call allowed an attacker to send funds through a malicious pool hook.
Yoink, the MEV robot takes over first position
PeckShield has identified this incident as an attack of approximately $7.81million involving the liquid restaking token rsETH associated with KelpDAO. This was after an MEV Bot placed its transaction in front of the suspect attacker.
Security researchers cite on-chain records that show Yoink received 2,900 RsETH at Ethereum block 25980525. From the total, the transaction sent 2,882.37 rsETH to the address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0.
The address’s balance was 2,882.36740883 RsETH at the time of the review. The initial reports didn’t mention a transfer to or from the specified address. Also, the information available did not reveal the identity of its owner nor establish if the funds will be returned.
The Pool Manager received 17.63 rsETH. The transaction flow shows that the pool manager sent 18,95 ETH from the Yoink contract to the Block Builder, who then forwarded the 18.93 ETH.
Payment of almost the entire ETH to the builder resulted in a very small ETH gain from this part of the deal. It appears that the large payment was the bot’s attempt to gain priority in the search results. However, the researchers cited did not provide a full profit calculation including the rsETH retained or any other transaction costs.
The original exploit and Yoink’s transactions both landed on block 25980525. Yoink was at the top, while the initial transaction ran and reversed later. Researchers viewed both the failed order and the subsequent transaction as proof that the bot detected and moved before the attacker.
This competition is based on the maxim extractable value (MEV), which can be achieved by controlling inclusion and order of transactions. A June 2026 crypto.news guide to MEV Searchers can scan for pending transactions to find profitable opportunities, then assemble bundles of transaction and pay the builders to position them at a desired location.
Safe Module Checks Allow the Exploit Path
BlockSec has attributed this weakness to the failure of authorization checks performed in a contract executor connected to Safe enabled module. According to the company, calls controlled by attackers could be routed through an executor contract that was trusted by the wallet.
Safe is an intelligent contract wallet that requires multiple signers for transactions. Safe’s modular framework lets users add contracts to their accounts that perform actions in accordance with pre-defined rules.
The wallet security perimeter is augmented by an enabled module. BlockSec’s analysis shows that the executor in question failed to verify the call’s authority correctly. This allowed an external party to access functions via a trusted path.
Report describes an issue with Ethereum’s consensus rather than a bug in Ethereum. Details available also don’t show that Safe core contracts were compromised. Attributing the incident solely to Safe would therefore go beyond security firms findings.
Blockaid gave a detailed description of the attack and how it was attempted. The security firm said that the attacker accessed a multi-call public keeper and sent a custom Uniswap v4 liquidation module to a hookpool under his control.
Uniswap v4 Hooks are contracts which can execute custom instructions in a pool at predetermined points. Blockaid stated that a maliciously-created hook pool then was used by the attacker to unpack aEthrsETH and rsETH in order to produce the tokens targeted for the transaction.
Blockaid analysis shows that combining a public-keeper function and a trusted route enabled the call to get to the custom liquidity set up. Yoink bot spotted the opportunity even before attackers completed the transaction and submitted another competing transaction that also captured the same output.
The reports do not include any statements that identify the suspect attacker, Yoink’s operator or block builders. Reports did not mention if a bounty agreement or legal proceedings had been initiated, nor if a recovery contract was in place.
DeFi’s losses in 2026 will be increased by the rsETH transaction
This attempted extraction occurred in a period of high losses for decentralized financial institutions. Reports from September on DeFi security losses In the first 8 months of 2026, exploits cost protocols at least $1.35 billion. This is according to CertiK estimates and Forbes.
In the report it was found that traditional smart contract errors had been surpassed by compromised credentials, privileged access and other faults. Yoink differs from other incidents in that BlockSec attributed the reported mechanisms to an opening within authorization logic of an executor connected to a Safe Module.
rsETH was also featured in a major security event earlier this year. A previous report stated that an attacker generated 116.500 rsETH in April after compromise infrastructure linked to a LayerZero Verifier. According to previous coverage, the attacker used these tokens on Aave as collateral for borrowing other assets.
Researchers haven’t connected the incident in April to the block 25980525 transaction. Two different weaknesses were reported in both cases. The latest incident involved an attempt to move 2,900 existing coins through the wallet execution path.
The U.S. government has labelled some MEV schemes fraud
The Yoink transaction is a good example for U.S. users of why this term exists. “front-running” The mere fact that a trade is on-chain does not determine its legal status. When prosecutors claimed that MEV operators were deceitful or had altered systems to gain funds, federal authorities investigated certain MEV operations.
The U.S. Department of Justice will be launching its new website in May 2024. charged two brothers Over an alleged Ethereum scam that generated about $25 million worth of cryptocurrency in just 12 seconds. The prosecution alleged that Anton Peraire-Bueno and James Peraire were manipulating the Ethereum trading process to gain access to private transactions.
The Justice Department filed charges against the brothers for conspiracy to perpetrate wire fraud and wire fraud as well as conspiracy to launder money. Instead of treating all transaction ordering strategies as criminal, the Justice Department focused its allegations on the methods that were allegedly used in order to get the trading data and manipulate the system.
According to the provided information, no U.S. regulators or law enforcement agencies have announced any action regarding Yoink or the attempted exploit of rsETH. According to the cited security companies, their research focused on transaction ordering, Safe-linked executors’ authorization checks and the Uniswap v4 loop route that was used to unpack aEthrsETH.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: crypto.news
