MEV Bot Front-Runs $7.8M rsETH Safe Wallet Exploit
FxRoy
•
September 15, 2026
•
14 views
An MEV bot just turned an attempted theft into its own payday on Ethereum.
Yoink Grabs the Prize Before the Thief
The bot, known as Yoink, spotted a transaction that aimed to drain 2,900 rsETH from a Safe wallet. That sum sat near $7.8 million at the time. Yoink paid almost 19 ETH in priority fees to land first in the block and claim the tokens itself.
It didn't work out for the original attacker.
Why Front-Running Still Matters in 2024
MEV activity on Ethereum has grown more sophisticated since the Merge. Bots now scan the mempool in real time for vulnerable calls, especially around restaking tokens like rsETH. The same infrastructure that protects validators also gives these operators an edge when exploits surface. Yesterday's incident fits a pattern seen in several large liquid-staking drains this year.
The Numbers Behind the Block
Yoink's gas bid reached roughly 19 ETH to guarantee inclusion ahead of the attacker. That fee alone would have covered most retail trading costs for months. The rsETH transfer sat in a Safe contract, a popular multi-sig setup that still leaves room for signature or approval exploits when users misconfigure permissions. No broader market selloff followed, but the tokens stayed with the bot rather than vanishing into an unknown wallet.
Market Positioning After the Incident
Restaking protocols have drawn heavy flows since EigenLayer reopened deposits earlier this year. rsETH holders watched the price hold steady through the event, suggesting limited immediate panic. Yet the episode shows how quickly value can shift hands when code meets an active mempool. Anyone running large positions in restaked assets now faces an extra layer of execution risk that didn't exist two years ago — a reminder that on-chain security isn't static.
Traders who monitor these flows saw similar bot behavior during the last major Curve pool incident. The difference this time was the size of the priority fee and the speed of the capture. For anyone positioned in rsETH or related derivatives, the takeaway sits in the gas data rather than the headline amount stolen.
Watch position sizing on any restaking exposure until Safe contract usage patterns become clearer. There's no guarantee the next attempt stays contained to a single block.