September 17, 2026

Anatomy of the rsETH hack: how $7.73M left a wallet in one transaction

On September 15, 2,900 rsETH (≈$7.73M) were drained from a Safe wallet on Ethereum. Safe, Aave, Uniswap and rsETH itself were not hacked. A custom automation module was — and that was enough.

What happened, step by step:

• The trap. Earlier that day the attacker deployed an empty token (PAT), a malicious hook, and created a Uniswap V4 pool rsETH ↔ PAT whose hooks field pointed to his own hook. Whoever sets the PoolKey chooses whose code runs inside the pool.
• The confused deputy. The victim's LP module had a public keeper function: it accepted the pool and hook address from the caller and executed via DELEGATECALL in the Safe's context — with no check that the target was allowed. The attacker simply passed his own PoolKey.
• Extraction. Acting as the wallet, the module redeemed 2,900 aEthrsETH from Aave → 2,900 rsETH and routed them into the attacker's pool. The hook rewired the settlement in its callbacks: rsETH went to the attacker, the wallet "received" worthless PAT.
• Exit. Everything was packed into one atomic MEV bundle (the Yoink bot, block 25,980,525): ≈2,882 rsETH (~$7.43M) landed on the recipient wallet, ≈18.9 ETH went to the block builder for guaranteed inclusion. The attacker had been funded through the RAILGUN mixer.

Why it worked: three mistakes stacked — a public entry point + caller-supplied parameters + delegatecall with no target allowlist. A module bypasses owner signatures by design, which makes it the most dangerous surface of any Safe.

How to prevent it: allowlist pools and hooks; never delegatecall into targets chosen by the caller; withdrawal limits and timelocks on new targets; least privilege for modules (an LP module has no business touching the Aave position); a separate audit for custom modules; monitoring with an automatic circuit breaker.

The practical takeaway for P2P and anyone accepting funds: the proceeds are already moving through the transfer graph and can reach an address that sends you an "ordinary" payment within hours. The exchange will see that link on your first withdrawal. Screen the counterparty before you accept.

🔗 Exploit transaction: https://etherscan.io/tx/0x0e7680b06cb8a6f86c149d9ba90d98e3d334e7b072dde03909d43fcfd98a8705 🔎 Check any address in 10 seconds: https://t.me/amlconsensus_bot?start=en