A hacker spent effort setting up an exploit against a Safe smart-contract wallet on Ethereum. On September 15, 2026, the attack fired, and within the same block another program grabbed the loot first. The bot, tagged on-chain as “Yoink,” paid roughly 18.93 ETH (about $46,000) to a block builder to jump the queue, then walked off with 2,900 rsETH worth close to $7.8 million. The original hacker got nothing.
The incident, confirmed by blockchain security firm Blockaid and reported by Cointelegraph and Unchained Crypto, has turned into one of the more debated crypto security stories of September 2026. It touches nearly every pressure point in decentralized finance right now: Safe wallet module risk, Uniswap v4 hook abuse, and the growing power of maximal extractable value (MEV) bots to act as accidental, or opportunistic, guardians of other people’s money. Five months earlier, a related protocol suffered one of the year’s biggest hacks. Now Kelp DAO’s rsETH token is back in the cryptocurrency headlines, this time as the asset a bot saved rather than the asset an attacker took.
What Happened on September 15: Inside the Safe Wallet Drain
The target was a Safe multisig wallet holding a leveraged rsETH position, structured through Aave’s wrapped token, aEthrsETH. According to Blockaid’s analysis, cited by Cointelegraph, the wallet had previously authorized a custom liquidity module tied to Uniswap v4. That module was meant to help manage the position automatically. It became the entry point for the attacker instead.
Around 2,900 rsETH, valued at $7.73 million to $7.8 million depending on the price snapshot used, moved out of the wallet in a single sequence of transactions. Multiple outlets, including CryptoTimes and Coinpedia, place the timing on the morning of September 15. The wallet itself belonged to an individual user rather than a protocol treasury, which is part of why the story initially looked like a routine, if expensive, personal loss.
The Attack Path: A Custom Module, a Malicious Hook, and 2,900 rsETH
The mechanics matter here, because they point to a specific and increasingly common weak spot in DeFi wallets. The attacker used a public keeper multicall function, a feature designed to let anyone trigger routine maintenance calls on a contract, to redirect the wallet’s custom Uniswap v4 module toward a pool the attacker had created. That pool used a malicious hook, a piece of code that runs before or after a Uniswap v4 swap and can rewrite what happens to the tokens involved.
Once routed through the hooked pool, the wallet’s aEthrsETH unwrapped into plain rsETH, stripping away the protections built into the Aave-wrapped version. From there, the rsETH sat exposed in the transaction for anyone fast enough to claim it. Security firms BlockSec, Blockaid, SlowMist, and AstraSec each concluded that the flaw lived in the user-authorized module, not in Safe’s core smart contract code or in Uniswap’s base protocol. That distinction has become the central defense both Safe and Kelp DAO have leaned on since.
Enter Yoink: How a Bot Out-Raced the Hacker in the Same Block
What separates this story from a routine drain is what happened next. The attacker’s transaction sat briefly in Ethereum’s public mempool before confirmation. An MEV bot known on-chain as Yoink spotted it, copied the exploit path, and paid a higher fee to get mined first in the same block. Etherscan data cited by Cointelegraph shows Yoink transferring about 18.93 ETH, roughly $46,000, to an address labeled as a block builder, buying its way to the front of the line.
The result: the original attacker’s carefully built exploit executed correctly, but the funds landed in Yoink’s wallet instead of theirs. This is not charity. MEV bots operate on pure profit logic, scanning the mempool for any transaction that can be copied, reordered, or intercepted for gain. In this case, the bot’s owner (still anonymous as of publication) happened to intercept a theft rather than an arbitrage opportunity. Coverage from Coinpedia and TradingView both frame it plainly: an MEV bot called “yoink” detected and front-ran the transaction, a mechanical description that undersells how strange the outcome was for everyone watching.
Kelp DAO’s Response: A 24-Hour Freeze and a Reassurance
Kelp DAO, the protocol behind rsETH, moved fast once the funds landed at Yoink’s receiving address. The team placed that address under a temporary hold, using contract-level controls available to the protocol for exactly this kind of situation.
“Out of an abundance of caution, we’ve placed that address under a temporary 24-hour pause.”
Kelp DAO, via Unchained Crypto
The pause was framed explicitly as a wallet-level measure rather than a sign of broader trouble with the token itself.
“This is a precautionary, wallet-level measure only.”
Kelp, via Cointelegraph
Kelp followed with a direct statement on the health of the token’s backing, aimed squarely at holders worried this might echo the much larger incident the protocol suffered in April.
“Kelp contracts are safe, rsETH remains fully backed.”
Kelp, via Cointelegraph
Timeline: 2026’s Major Crypto Security Incidents So Far
Placed against the rest of 2026, the September 15 incident is small in dollar terms but large in what it reveals about where attackers, and now bots, are focusing their effort. The table below lines up the year’s biggest DeFi and crypto security events, drawing on figures reported by Cointelegraph, Coinpaper, and QuillAudits research.
| Date | Incident | Loss / Value Involved | Root Cause |
|---|---|---|---|
| April 18, 2026 | Kelp DAO rsETH / LayerZero bridge hack | ~$292M–$293M (116,500 rsETH) | Single-verifier DVN config, RPC poisoning, attributed to DPRK’s Lazarus Group |
| H1 2026 (Jan–Jun) | 87 tracked DeFi incidents | $935.3M total | 82.7% tied to private key compromise or bridge verification failures (QuillAudits) |
| July 2026 | Monthly DeFi/crypto hack total | ~$270M | Mixed: bridges, exchange breaches, contract bugs |
| August 2026 | Record 50 hacks in one month | ~$136.3M (down 49.5% month over month) | Mixed, smaller average payout per incident |
| September 15, 2026 | Safe wallet / Uniswap v4 hook exploit (Yoink incident) | ~$7.7M–$7.8M (recovered by MEV bot, not attacker) | User-authorized custom module plus malicious hook, not a core protocol bug |
Two things stand out. First, the attacker who built the September 15 exploit walked away with nothing, an outcome that almost never shows up in hack statistics because it doesn’t fit neatly into “loss” or “recovery” columns. Second, the incident count for 2026 keeps climbing even as average payouts shrink, a pattern our earlier coverage of August’s record 50 hacks already flagged.
Vigilante or Thief? The Murky Ethics of White-Hat MEV
Crypto Twitter and trading Discords spent the days after September 15 arguing over how to categorize Yoink. Some called it a white-hat rescue, framing the bot as an accidental hero that kept $7.8 million out of criminal hands. Others pointed out that Yoink is not a registered security researcher, has made no public statement, and has given no indication it intends to return the funds to the original wallet owner. By that read, Yoink simply out-competed a thief, and the victim is no better off than if the original attacker had succeeded.
Both readings can be true at once. MEV bots exist to extract value from ordering transactions, full stop. They do not distinguish between an arbitrage opportunity and a theft in progress unless their operator has specifically coded that distinction in. What happened on September 15 looks less like intentional vigilantism and more like a lucky, mechanical side effect of a bot doing exactly what it was built to do: scan for profitable transactions and grab them first. That it happened to deny a hacker a payday reads as justice, even though the logic behind it was pure profit.
Why Uniswap v4 Hooks Keep Becoming Attack Surfaces
The exploit vector here, a malicious hook attached to a Uniswap v4 pool, is not an isolated design flaw. It is a symptom of how the protocol’s newest version works. Uniswap v4 lets developers attach custom code, hooks, that execute before or after a swap, unlocking flexibility that was impossible in earlier versions. That flexibility cuts both ways. A hook can enable dynamic fees or custom order types. It can also unwrap a wrapped token, redirect a transfer, or manipulate a swap in ways a user never agreed to.
Independent security firm 0x published research, covered by TechFlow and Futunn, analyzing 84,163 Uniswap v4 hooks deployed across six chains over the preceding 18 months, with data current as of September 11, 2026, just four days before the Yoink incident. The findings are stark.
Uniswap v4 Hook Security Breakdown (0x Research, September 2026)
| Classification | Share of Hooks Analyzed | What It Means |
|---|---|---|
| Safe | 19.4% | No flagged risk patterns in code or behavior |
| Malicious | 54.2% | Contains logic patterns consistent with rug-pull or fund-diversion risk |
| Highly likely malicious | 26.4% | Strong risk indicators but not confirmed exploited |
| Total analyzed | 84,163 hooks | Across six chains, 18-month sample window ending September 11, 2026 |
Read together, roughly four out of five hooks in the sample carry some level of flagged risk. That does not mean four out of five hooks will end up in an active exploit. Most sit unused or interact with trivial amounts of value. But it does mean the attack surface Uniswap v4’s hook system opened up is far larger than the handful of headline incidents suggest, and the September 15 Safe wallet drain is a data point inside that much bigger pattern rather than a freak occurrence.
Market Impact: What This Means for rsETH, Kelp DAO, and DeFi Confidence
rsETH’s price and liquidity held up through the incident, a notable contrast to the token’s April ordeal, when a much larger drain triggered a roughly $13 billion drop in total DeFi value locked within 48 hours, from about $99.5 billion to $86.3 billion, according to Galaxy Research’s post-mortem of that event. The September 15 exploit involved a single user’s wallet rather than the protocol’s bridge infrastructure, which limited contagion risk almost entirely.
Still, the incident lands at an awkward moment for Kelp DAO’s credibility. The protocol already spent May and June rebuilding trust after the April hack, including a documented move away from LayerZero’s cross-chain messaging toward Chainlink’s CCIP infrastructure, reported at the time by The Block. A second rsETH-linked headline within five months, even one where the protocol itself was not directly at fault, keeps the token’s name tied to security incidents in a way that makes integrators and lenders like Aave more cautious about collateral limits and risk parameters going forward.
The Bigger Picture: 2026’s Hack Count Rises as Average Payouts Shrink
Zoom out and the Yoink incident fits a broader trend our newsroom has tracked through 2026. August set a record for the sheer number of hacks in a single month, 50 separate incidents, yet total losses fell nearly 50% from July, landing around $136.3 million versus roughly $270 million the month before, per Coinpaper’s tracking. Attackers are hitting more targets for smaller individual amounts, a shift consistent with the kind of narrow, single-wallet exploit that hit the Safe user on September 15.
QuillAudits research covering the first half of 2026 found that 82.7% of the $935.3 million lost across 87 tracked DeFi incidents traced back to private key compromise or bridge verification failures rather than raw smart contract bugs. That statistic, which we broke down in detail in our analysis of stolen keys versus code bugs, lines up closely with what happened here. The exploited component wasn’t Safe’s audited core contract or Uniswap’s base protocol. It was a user-authorized module sitting at the edge of both systems.
Historical Context: From April’s $293M LayerZero Hack to September’s Near-Miss
To understand why the crypto security community reacted so strongly to a $7.8 million incident, a small figure by 2026 standards, it helps to remember what rsETH already went through this year. On April 18, 2026, attackers linked to North Korea’s Lazarus Group drained 116,500 rsETH, worth $292 million to $293 million, from Kelp DAO’s LayerZero-powered cross-chain bridge. That hack exploited a single-verifier configuration in LayerZero’s Decentralized Verifier Network, letting attackers forge a cross-chain message and unlock funds that were never actually deposited.
The aftermath was severe. Aave’s bad debt exposure from the event was estimated at $123.7 million under a uniform loss-sharing model, or as high as $230.1 million if losses were isolated to Layer 2 rsETH holders, according to Galaxy Research’s technical breakdown. LayerZero later issued a public apology admitting fault in the single-verifier setup and announced it would no longer sign messages for applications using that configuration going forward.
September’s incident is a different animal technically, rooted in a Safe wallet module and a Uniswap v4 hook rather than a bridge verifier. But the throughline is the same: complex, permissioned components bolted onto otherwise well-audited systems keep turning into the weakest link, and rsETH keeps being the asset caught in the middle.
Safe Wallets vs the Alternatives: How Multisig Security Stacks Up
Safe remains the dominant smart-contract wallet standard in DeFi, used by treasuries, DAOs, and individual power users who want multi-signature protection without giving up programmability. That programmability is precisely what created the opening here. Safe’s core contracts were not compromised. The wallet owner had authorized a third-party module, a common and often necessary practice for automated strategies, and that module became the failure point once combined with a malicious Uniswap v4 hook. Readers who want the setup steps for a properly configured multisig can check our Safe multisig setup guide, published after the $1.5 billion Bybit hack.
Hardware-wallet-based cold storage avoids this specific risk entirely by design, since cold wallets generally don’t execute arbitrary on-chain module logic without a fresh, manual signature for every transaction. The tradeoff is convenience: automated strategies, yield routing, and one-click liquidity management simply aren’t possible without some form of delegated permission, which is exactly what Safe’s module system provides. Institutional custody platforms sit somewhere in between, typically requiring internal policy approval before any new module or integration goes live, a slower but more controlled process than the open, permissionless module approval most retail Safe users rely on.
The practical lesson security firms have pushed since September 15 is narrower than “avoid Safe” or “avoid Uniswap v4.” It’s that any wallet owner who authorizes a custom module, on any smart-contract wallet, is extending their trust boundary to include that module’s entire code path, including any pool or hook it might interact with later. That boundary stays invisible to most users until something like this happens.
MEV’s Growing Footprint: The Economics Behind Bots Like Yoink
Bots like Yoink don’t operate in a vacuum. MEV extraction on Ethereum has grown steadily as an industry-wide phenomenon, with rough estimates putting annual MEV extracted on the network near $2.5 billion in 2026, up from an estimated $2.2 billion in 2025 and $1.8 billion in 2024, based on aggregated chain-level tracking. Those figures should be treated as directional rather than exact, since no single dashboard captures every form of MEV. What they show clearly is a searcher economy large enough, and well-funded enough, to have bots watching every corner of the mempool around the clock, ready to react in milliseconds to whatever opportunity, legitimate or criminal, appears next.
That scale echoes shifts we’ve tracked in MEV relay dynamics throughout 2026, and explains why an exploit built by one attacker got intercepted by another party entirely within a single block. Someone, somewhere, running a competitive MEV bot was watching that exact pool for exactly that kind of anomalous transaction. Given how much capital now runs through searcher infrastructure, incidents like this one are likely to keep happening, not because bots are hunting for hackers specifically, but because any sufficiently visible, sufficiently profitable transaction in the mempool now has a good chance of getting front-run by someone.
What Happens Next: 5 Predictions for MEV, Modules, and DeFi Security
- Hook allow-lists gain traction. Expect major DeFi front-ends and aggregators to start filtering out unverified Uniswap v4 hooks by default, using data similar to 0x’s 84,163-hook study, rather than leaving that judgment entirely to end users.
- Safe tightens module warnings. Given how cleanly security firms isolated this exploit to a user-authorized component, expect wallet interfaces to add explicit, harder-to-dismiss warnings before a user approves any third-party module, not just at install but on every subsequent high-value transaction.
- MEV bots get coded ethics, selectively. A handful of MEV searcher teams will likely start building explicit “rescue” logic aimed at intercepting known exploit patterns, marketing it as a service, since the Yoink story generated enough attention to make that a viable positioning strategy.
- Kelp DAO keeps diversifying infrastructure. Having already shifted from LayerZero to Chainlink’s CCIP after April, expect Kelp DAO to publish additional hardening measures around wallet-level integrations and module whitelisting for any product that touches rsETH directly.
- Incident counts keep climbing, average payouts keep shrinking. If the July-to-August pattern holds, where hack counts rose but total losses fell nearly 50%, September and October 2026 likely bring more frequent, smaller, module-and-hook-level exploits rather than another mega-bridge hack on the scale of April’s $293 million event.
Frequently Asked Questions
What exactly happened in the September 15, 2026 Safe wallet exploit?
An attacker exploited a custom Uniswap v4 liquidity module authorized by a Safe smart-contract wallet, routing the wallet’s aEthrsETH position through a malicious hooked pool to unwrap it into roughly 2,900 rsETH, worth about $7.7 million to $7.8 million. Before the attacker could claim the funds, an MEV bot named Yoink copied the transaction and paid higher fees to get mined first, taking the funds for itself instead.
Who or what is the MEV bot “Yoink”?
Yoink is the on-chain label for an automated MEV (maximal extractable value) bot that monitors Ethereum’s public mempool for profitable transactions and races to execute them first. Its operator has not been publicly identified, and there is no confirmation the bot intends to return the intercepted funds.
Is rsETH safe to hold after this incident?
Kelp DAO stated that its core contracts were unaffected and that rsETH “remains fully backed.” Security firms including Blockaid, BlockSec, SlowMist, and AstraSec traced the exploit to a user-authorized module rather than Kelp DAO’s or Safe’s core code, meaning the protocol itself was not directly breached.
Was this the same incident as the $293 million Kelp DAO hack from earlier in 2026?
No. That hack occurred on April 18, 2026, and targeted Kelp DAO’s LayerZero cross-chain bridge directly, draining 116,500 rsETH worth around $292 million to $293 million. The September 15 incident targeted a single user’s Safe wallet through an unrelated Uniswap v4 module vulnerability and involved a far smaller amount.
Did the original hacker get away with any funds?
No. Based on on-chain data reviewed by Cointelegraph and Blockaid, the Yoink bot’s transaction was mined ahead of the attacker’s, meaning the original hacker received nothing from the exploit they engineered.
What is a Uniswap v4 hook, and why did it matter here?
A hook is custom code attached to a Uniswap v4 liquidity pool that runs before or after a swap, letting developers customize pool behavior. Attackers can deploy malicious hooks that manipulate what happens to tokens passing through a pool. Independent research from 0x found that 54.2% of 84,163 analyzed Uniswap v4 hooks carried malicious risk indicators as of September 11, 2026.
How can Safe wallet users avoid a similar exploit?
Security researchers recommend reviewing every third-party module a Safe wallet has authorized, since a module extends the wallet’s trust boundary to include that module’s full code path and anything it later interacts with, including unverified Uniswap v4 pools and hooks. Revoking unused module permissions and avoiding public keeper multicall functions on high-value wallets reduces this specific attack surface.
Is what Yoink did legal?
MEV extraction through transaction ordering and priority fees is a standard, permitted mechanism on Ethereum, used routinely for arbitrage and liquidations. Whether intercepting funds mid-exploit counts as theft, recovery, or something in between remains legally and ethically unsettled, and no regulator has issued specific guidance on this exact scenario as of publication.
