MEV Bot Yoink Front‑Runs $7.8 M rsETH Exploit on Ethereum

An MEV (maximal extractable value) bot called Yoink intercepted an attempted exploit of a Safe smart‑contract wallet on Ethereum, seizing 2,900 rsETH—approximately $7.8 million—by front‑running the attacker’s transaction.

How the bot captured the funds

Yoink submitted a transaction that placed it at the top of block 25980525, paying roughly 18.93 ETH to the block builder as a bid for priority. The bot received the full 2,900 rsETH before the original exploit transaction executed later in the same block and subsequently reverted.

• 2,882.37 rsETH was transferred to address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0.
• 17.63 rsETH was routed through a Uniswap v4 pool manager, which then sent 18.95 ETH to the Yoink contract.

Root cause of the attempted exploit

Security researchers identified weak authorization checks in an executor contract linked to a Safe module as the vulnerability. The executor allowed attacker‑controlled calls to pass through a trusted route, enabling the attacker to use a public keeper multicall and a custom Uniswap v4 hook pool to convert aEthrsETH into rsETH.

Implications for DeFi security

The incident adds to a series of large DeFi losses in 2026, where compromised credentials and privileged‑access attacks have become the dominant source of value loss. It also highlights the role of MEV bots in detecting and pre‑empting exploit attempts.

Legal context

U.S. authorities have previously pursued MEV‑related schemes when deception or fraud is alleged, but no regulatory action has been announced regarding Yoink or the rsETH exploit.