Unnamed rsETH holder (Safe strategy module) hack — September 2026

A Safe multisig wallet belonging to a large holder of leveraged rsETH lost about 2,882 rsETH, roughly $7.8m, on 15 September 2026. The loss came from a third-party module installed on the wallet, not from Safe itself or from Kelp DAO, which issues rsETH.

The Safe had authorised a third-party strategy-executor module. Its recipe entry point passed calldata supplied by the caller into the Safe as a DELEGATECALL without checking who was calling, so anyone who could reach it could run code as the Safe. The attacker used it to route the Safe's Uniswap v4 liquidity module into a hooked pool they had created, which paired a worthless token they called the Permissionless Attacker Token against roughly 2,900 aEthrsETH. A custom hook unwrapped the aEthrsETH into rsETH that could be taken out. Blockaid, PeckShield and BlockSec confirmed the exploit.

The attacker sent the transaction through the public mempool, where an MEV bot known as yoink front-ran it and took the whole ~2,882 rsETH to an address of its own. Kelp DAO flagged that address and put it under a 24-hour pause so the rsETH could not move, and said its core contracts were secure and rsETH fully collateralised. The funds are gone from the victim either way; whether the bot's operator gives them back is open.

The amount is 2,882 rsETH at about $2,708, the CoinGecko rsETH price at the start of 15 September. Some reports put it at $7.73m, which is kept as the low end. Neither the wallet's owner nor the module's developer has been named.