{
  "version": 1,
  "event_id": "evt_0f81771227434d7f",
  "url": "https://xiyu.news/events/evt_0f81771227434d7f/",
  "json": "https://xiyu.news/api/events/evt_0f81771227434d7f.json",
  "type": "security_incident",
  "status": "monitoring",
  "category": "crypto",
  "title": {
    "zh": "MEV机器人抢先拦截770万美元rsETH漏洞利用，Kelp冻结相关地址",
    "en": "ETH wallet exploit backfires as MEV bot captures $7.7M, Kelp freezes address"
  },
  "current_state": {
    "zh": "攻击者利用一个连接以太坊Safe钱包的自定义模块，试图盗取约773万美元的rsETH（约2900枚），但被名为“Yoink”的MEV机器人抢先交易并截走资金。rsETH发行方Kelp随后将接收地址置于24小时暂停状态，该机器人已将2882.37枚rsETH转入单一地址。\n\n该事件表明，即使核心钱包合约本身安全，诸如自定义Safe模块这类扩展也可能成为最薄弱的一环；同时也显示MEV机器人正日益成为被盗资金的“意外拦截者”。这直接关系到rsETH持有者，以及依赖该流动性质押代币提供流动性和抵押品的DeFi集成方。\n\n据Blockaid分析，攻击者通过公开的keeper multicall，将一个自定义的Uniswap v4流动性模块导入其自建的hooked池，在此过程中将aEthrsETH解包为rsETH。同一笔交易中，Yoink向一个被标记为区块构建者的地址转出约18.93枚ETH（约4.6万美元）；Kelp则强调此次暂停仅是钱包层面的预防措施，其合约安全，rsETH仍保持100%足额支撑。",
    "en": "An attacker exploiting a custom Safe module to extract ~$7.7M in rsETH was front-run by the MEV bot 'Yoink,' which captured the funds before Kelp temporarily froze the receiving address."
  },
  "first_seen_at": "2026-09-15T17:11:55.479979+00:00",
  "last_updated_at": "2026-09-15T17:11:55.479979+00:00",
  "last_material_change_at": "2026-09-15T17:11:55.479979+00:00",
  "confidence": 0.75,
  "updates_count": 1,
  "sources_count": 2,
  "entities": [
    "kelp",
    "mev"
  ],
  "identifiers": [],
  "topics": [
    "mev",
    "rseth",
    "security-exploit"
  ],
  "updates": [
    {
      "update_id": "upd_d0ec44a162f8fca4",
      "event_id": "evt_0f81771227434d7f",
      "occurred_at": "2026-09-15T15:21:26Z",
      "published_at": "2026-09-15T15:21:26Z",
      "first_seen_at": "2026-09-15T17:11:55.479979Z",
      "time_precision": "published",
      "update_type": "initial",
      "material_change": true,
      "title_zh": "MEV机器人抢先拦截770万美元rsETH漏洞利用，Kelp冻结相关地址",
      "title_en": "ETH wallet exploit backfires as MEV bot captures $7.7M, Kelp freezes address",
      "what_changed_zh": "攻击者利用一个连接以太坊Safe钱包的自定义模块，试图盗取约773万美元的rsETH（约2900枚），但被名为“Yoink”的MEV机器人抢先交易并截走资金。rsETH发行方Kelp随后将接收地址置于24小时暂停状态，该机器人已将2882.37枚rsETH转入单一地址。\n\n该事件表明，即使核心钱包合约本身安全，诸如自定义Safe模块这类扩展也可能成为最薄弱的一环；同时也显示MEV机器人正日益成为被盗资金的“意外拦截者”。这直接关系到rsETH持有者，以及依赖该流动性质押代币提供流动性和抵押品的DeFi集成方。\n\n据Blockaid分析，攻击者通过公开的keeper multicall，将一个自定义的Uniswap v4流动性模块导入其自建的hooked池，在此过程中将aEthrsETH解包为rsETH。同一笔交易中，Yoink向一个被标记为区块构建者的地址转出约18.93枚ETH（约4.6万美元）；Kelp则强调此次暂停仅是钱包层面的预防措施，其合约安全，rsETH仍保持100%足额支撑。",
      "what_changed_en": "An attacker exploiting a custom Safe module to extract ~$7.7M in rsETH was front-run by the MEV bot 'Yoink,' which captured the funds before Kelp temporarily froze the receiving address.",
      "current_state_zh": "攻击者利用一个连接以太坊Safe钱包的自定义模块，试图盗取约773万美元的rsETH（约2900枚），但被名为“Yoink”的MEV机器人抢先交易并截走资金。rsETH发行方Kelp随后将接收地址置于24小时暂停状态，该机器人已将2882.37枚rsETH转入单一地址。\n\n该事件表明，即使核心钱包合约本身安全，诸如自定义Safe模块这类扩展也可能成为最薄弱的一环；同时也显示MEV机器人正日益成为被盗资金的“意外拦截者”。这直接关系到rsETH持有者，以及依赖该流动性质押代币提供流动性和抵押品的DeFi集成方。\n\n据Blockaid分析，攻击者通过公开的keeper multicall，将一个自定义的Uniswap v4流动性模块导入其自建的hooked池，在此过程中将aEthrsETH解包为rsETH。同一笔交易中，Yoink向一个被标记为区块构建者的地址转出约18.93枚ETH（约4.6万美元）；Kelp则强调此次暂停仅是钱包层面的预防措施，其合约安全，rsETH仍保持100%足额支撑。",
      "current_state_en": "An attacker exploiting a custom Safe module to extract ~$7.7M in rsETH was front-run by the MEV bot 'Yoink,' which captured the funds before Kelp temporarily froze the receiving address.",
      "detailed_summary_zh": "An attacker exploiting a custom Safe module to extract ~$7.7M in rsETH was front-run by the MEV bot 'Yoink,' which captured the funds before Kelp temporarily froze the receiving address.",
      "detailed_summary_en": "An attacker exploiting a custom Safe module to extract ~$7.7M in rsETH was front-run by the MEV bot 'Yoink,' which captured the funds before Kelp temporarily froze the receiving address.",
      "background_zh": "rsETH 是 Kelp DAO 发行的流动性再质押代币（LRT），代表通过 EigenLayer 式再质押的 ETH，同时可在 DeFi 中使用。Safe 是广泛使用的智能合约钱包，其模块化设计允许用户挂载按既定规则执行交易的自定义模块，因此模块本身成为高权限攻击目标。Uniswap v4 的 hook 是可选的插件，可让流动性池自定义行为，但如果某个模块能被指向攻击者控制的池子，也可能被滥用。MEV 机器人（搜索者）会监控内存池中的有利可图交易，并向区块构建者付费以让自己的交易在区块中被优先排序。",
      "background_en": "rsETH is a Liquid Restaked Token issued by Kelp DAO, representing ETH that has been restaked through EigenLayer-style restaking while remaining usable in DeFi. Safe is a widely used smart-contract wallet whose modular design lets users attach custom modules that execute transactions under defined rules, making the module itself a privileged target. Uniswap v4 hooks are optional plugins that let pools customize behavior, but they can also be weaponized if a module can be pointed at an attacker-controlled pool. MEV bots, or searchers, monitor the mempool for profitable transactions and pay block builders to have their own transaction ordered first in a block.",
      "community_discussion_zh": "",
      "community_discussion_en": "",
      "market_impact_zh": "该事件影响 rsETH 及再质押/LRT 板块：地址级别的 24 小时冻结，加上对自定义 Safe 模块风险的担忧，可能对 rsETH 及同类流动性再质押代币的二级市场流动性和赎回信心造成压力。由于损失规模不足 800 万美元，对更广泛 ETH 市场的溢出效应有限，但它强化了市场对再质押体系中薄弱环节仍在于 DeFi 集成层而非核心协议合约的看法。",
      "market_impact_en": "The incident affects rsETH and the restaking/LRT segment: a 24-hour address-level freeze and questions about custom Safe module risk can weigh on secondary-market liquidity and redemption confidence for rsETH and comparable liquid restaking tokens. Spillover to broader ETH markets is limited by the sub-$8 million size, though it reinforces perceptions that DeFi integrations, rather than core protocol contracts, remain the weakest link in the restaking stack.",
      "importance_score": 7.5,
      "references": [
        {
          "url": "https://www.coingecko.com/en/coins/kelp-dao-restaked-eth",
          "title": "Kelp DAO Restaked ETH Price: RSETH/USD Live Price Chart ..."
        },
        {
          "url": "https://developers.uniswap.org/docs/protocols/v4/concepts/hooks",
          "title": "Uniswap v4 Hooks | Uniswap Developers"
        },
        {
          "url": "https://www.bybit.com/en/wiki/article/front-running-in-crypto-mev-bots-protection/",
          "title": "Front Running in Crypto: MEV Bots & Protection | Bybit Wiki"
        },
        {
          "url": "https://financefeeds.com/mev-bot-captures-7-7m-in-rseth-after-safe-module-exploit/",
          "title": "MEV Bot Front-Runs $7.7M rsETH Exploit on Safe Wallet"
        },
        {
          "url": "https://kerneldao.com/kelp/",
          "title": "Kelp – The Leading Liquid Restaking Protocol | Restake Ethereum..."
        },
        {
          "url": "https://cointelegraph.com/news/mev-bot-intercepts-77m-in-rseth-from-ethereum-wallet-exploit",
          "title": "MEV Bot Front-Runs $7.7M Ethereum Wallet Exploit"
        }
      ],
      "confidence": 0.75,
      "story_ids": [
        "rss:cointelegraph.com_rss:2c30f3242ce3741a",
        "rss:thedefiant.io_api_feed:afaa94ba1204986b"
      ],
      "sources": [
        {
          "url": "https://cointelegraph.com/news/mev-bot-intercepts-77m-in-rseth-from-ethereum-wallet-exploit?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound",
          "label": "Cointelegraph",
          "source_type": "rss",
          "official": false
        },
        {
          "url": "https://thedefiant.io/news/hacks/mev-bot-front-runs-7-8-million-rseth-exploit-on-ethereum",
          "label": "The Defiant",
          "source_type": "rss",
          "official": false
        }
      ]
    }
  ]
}