MEV Bot Yoink Front‑Runs $7.8 Million rsETH Exploit on Ethereum

An MEV bot identified as Yoink front‑ran a large exploit targeting a Safe wallet on Ethereum, capturing roughly $7.8 million worth of rsETH.

Transaction Details

The Yoink transaction received about 2,900 rsETH and immediately transferred 2,882.37 rsETH to the address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0. Etherscan shows a balance of 2,882.36740883 rsETH at that address.

In the same transaction, 17.63 rsETH was sent to Uniswap’s v4 Pool Manager, which returned 18.95 ETH to the Yoink contract. The contract then forwarded 18.93 ETH to the block builder.

Block Placement

Both the Yoink transaction and the original exploit transaction were included in Ethereum block 25980525 at 12:38 a.m. ET. Yoink’s transaction occupied position zero, causing the original exploit transaction to revert during execution.

Root Cause of the Exploit

Security researchers linked the exploit to a flawed authorization check in an executor contract attached to an enabled Safe module. The flaw allowed attacker‑controlled calls to execute through a trusted executor.

Blockaid reported that the attacker used a public keeper multicall to direct a custom Uniswap v4 liquidity module into a maliciously crafted pool. A hook in that pool unwrapped aEthrsETH into rsETH.

BlockSec added that approximately 2,900 aEthrsETH were moved into a Uniswap v4 pool paired with a token named Permissionless Attacker Token, leaving the Safe with a liquidity‑position NFT.