MEV Bot Front-Runs $7.8M rsETH Exploit on Ethereum
An MEV bot known as Yoink front-ran a reported rsETH exploit on Ethereum on September 15, 2026, withdrawing nearly 2,900 rsETH valued at approximately $7.
An MEV bot known as Yoink front-ran a reported rsETH exploit on Ethereum on September 15, 2026, withdrawing nearly 2,900 rsETH valued at approximately $7.8 million before the original attack transaction could execute, according to on-chain data and security researchers.
MEV Bot Front-Runs Reported $7.8 Million rsETH Exploit
KEY POINTS
- MEV bot Yoink front-ran a reported rsETH exploit, landing at position zero in Ethereum block 25980525 on September 15, 2026.
- Etherscan records the bot withdrawing 2,899.99 rsETH ($7,476,833.83) from Aave, then forwarding 2,882.37 rsETH ($7,431,373.16) to an external address.
- The identity of the Safe wallet owner and the ultimate controller of the receiving address remain unconfirmed by any first-party statement.
rsETH is a liquid restaking token issued on Ethereum, representing staked ETH positions that accrue additional yield through restaking protocols. Its deep integration with lending markets like Aave means large positions can be withdrawn or liquidated through smart-contract calls, creating a target surface that MEV bots actively monitor in the public mempool. For related coverage, see Bitcoin Hits $82,000 After Fed Dovish Signals as Ethereum, XRP, Dogecoin Jump.
Security firm PeckShield was among the first to characterize the event publicly, describing it as a front-run of a roughly $7.81 million rsETH exploit on Ethereum. For related coverage, see Bitcoin ETF Outflows Erase Monday Rebound Ahead of Fed.
#PeckShieldAlert MEV bot yoink front-runs a ~$7.81M $rsETH exploit on Ethereum pic.twitter.com/vAJwsCOfsQ
— PeckShieldAlert (@PeckShieldAlert) September 15, 2026
Source: @PeckShieldAlert on X
The Transaction Sequence
According to Etherscan records for block 25980525, Yoink’s transaction executed at 04:38:47 AM UTC on September 15, 2026. The bot withdrew 2,899.999999999997756819 rsETH, valued at $7,476,833.83 at execution, from Aave. For related coverage, see Fed Meeting Could Hurt Warsh’s Case, but Bitcoin May Shine.
Yoink then forwarded 2,882.37 rsETH, valued at $7,431,373.16, to the address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0. The identity and ultimate controller of that receiving address have not been established by the available evidence.
The Defiant reported that Yoink and the original attack transaction landed in the same Ethereum block, with Yoink occupying position zero and the original attacker’s transaction reverting. Achieving block position zero requires submitting a transaction with a higher priority fee or using a private relay, a technique common among professional MEV operators.
What Remains Unconfirmed
Security firm Blockaid said its exploit-detection system flagged an exploit on an unidentified user’s Safe wallet on Ethereum, reporting approximately $7.73 million in confirmed rsETH loss. Blockaid did not publicly name the Safe owner.
Multiple secondary reports attributed the affected Safe to Kelp DAO and claimed the protocol froze related funds. No first-party statement from Kelp DAO, Safe, Aave, or the wallet owner was verified in the available evidence. Those claims should be treated as unconfirmed.
What the rsETH Exploit Means for DeFi Users and Protocols
Execution Risk in Public Mempools
This incident illustrates a structural tension in Ethereum’s public mempool: any transaction broadcast without private relay infrastructure is visible to MEV bots before inclusion. In DeFi security incidents, this cuts both ways. A bot front-running an exploit may prevent a designated attacker from capturing funds, but the bot itself retains the proceeds rather than returning them to the affected party.
The outcome here, where roughly $7.4 million moved to an address of unknown ownership, mirrors patterns seen in earlier DeFi incidents. The DeFi bridge exploit involving fabricated BTC tokens similarly demonstrated how unauthorized token flows can cascade through interconnected protocol layers before any human response is possible.
Protocol Security Lessons
The use of a Safe multisig wallet as the apparent victim is notable. Safe is widely deployed by DAOs and institutional DeFi participants specifically because it requires multiple signers. An exploit targeting a Safe suggests either a compromised signer key, a malicious transaction approved by quorum, or a module vulnerability rather than a simple private key breach.
Aave’s role as the liquidity layer from which the rsETH was withdrawn points to the compounding risk of using liquid restaking tokens as collateral in lending markets. Position sizes large enough to generate $7.4 million in a single withdrawal are inherently attractive MEV targets, regardless of whether the triggering transaction is an exploit or a routine liquidation. Protocol teams assessing similar collateral risks across other chains face comparable mempool exposure.
Limits of On-Chain Attribution
At the time of publication, Ethereum was trading at $2,412.37, up 0.14% over 24 hours, with the broader crypto market sentiment index registering 51 (Neutral). The macro backdrop did not amplify the incident’s immediate price impact on rsETH or ETH.
On-chain data can confirm what moved, when, and to which addresses, but it cannot confirm intent, protocol attribution, or fund recovery without off-chain disclosure. Until the Safe owner, Kelp DAO if involved, or the controller of the receiving address issues a statement, the final disposition of the approximately $7.4 million in rsETH remains an open question for the Ethereum DeFi ecosystem.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
