ETH wallet exploit backfires as MEV bot captures $7.7M, Kelp freezes address
An MEV bot known as “Yoink” front-ran an attacker attempting to exploit a custom Safe module, capturing the stolen rsETH before Kelp temporarily froze the receiving address.
Asanat Analysis — Why it matters
This incident illustrates the adversarial dynamics now endemic to Ethereum's MEV landscape. A custom Safe module vulnerability created an attack surface, but rather than the attacker securing funds, an MEV bot intercepted the transaction flow and captured the stolen rsETH. This represents a second-order extraction layer: attackers themselves becoming victims of extraction. The Kelp freeze mechanism signals that protocol teams maintain circuit-breaker authority over liquid staking derivatives, a centralization vector that contradicts the trustless narrative around LSTs.
The $7.7M capture by 'Yoink' reflects both the sophistication and scale of MEV automation—bots now monitor not just on-chain transactions but exploit attempts in real-time. For Kelp (Kelp DAO's liquid restaking protocol), the address freeze mitigates immediate contagion but raises questions about rsETH's composability guarantees. The incident also highlights risks in custom Safe modules, which fragment security assumptions compared to simpler multisig implementations. This will likely accelerate industry consolidation around audited, standardized integrations rather than bespoke configurations.