An attacker exploited a custom module linked to an Ethereum Safe wallet to extract about $7.7 million in rsETH, but a MEV bot called Yoink intercepted the funds before the exploiter secured them. Blockchain security firm Blockaid reported that the attacker used a public keeper multicall to redirect a Uniswap v4 liquidity module into a hooked pool, unwrapping aEthrsETH into rsETH in a vulnerable configuration. Kelp, issuer of rsETH, froze the receiving address for 24 hours as a precaution, stressing that rsETH remains fully backed while minting, withdrawals and integrations continue and security experts investigate the compromised module.
This update represents a notable development in the Crypto sector. Organizations and founders tracking this space should evaluate potential strategic and technical implications on their operations.