DeFi

Gnosis

Safe

Yoink

An unidentified Gnosis Safe wallet was exploited for nearly $7.8M in rsETH. The attack drained DeFi liquidity, leaving the token and vaults with worthless tokens.&nbsp;
An attack was registered on September 15 against a Gnosis Safe wallet user, who has not yet been identified. The wallet was exploited for $7.73M in rsETH, according to Blockaid data.&nbsp;
The wallet was drained in a single transaction, taking away the equivalent&nbsp;<a href="https://etherscan.io/tx/0xe73c28b90b23d61faf8a6b37e94f6d0551441492d47e9ce768b604d5e42217d3" rel="noopener noreferrer nofollow">of 2,153 ETH</a>, which was later split and moved across multiple wallets.&nbsp;The initial transaction shows the funds were finally parked in <a href="https://etherscan.io/tx/0x0e7680b06cb8a6f86c149d9ba90d98e3d334e7b072dde03909d43fcfd98a8705" rel="noopener noreferrer nofollow">rsETH</a>, without being swapped into ETH on the main chain for further laundering.&nbsp;
This is the next major hack after the Bitcoin Pay hacker took <a href="https://www.cryptopolitan.com/swiss-bitcoin-pay-hacker-access/" rel="noopener noreferrer nofollow">4,000 BTC</a> from non-custodial user wallets. For September to date, decentralized hacks and exploits already surpass the level for the whole of August. 
In the past three months, exploits have accelerated from their lows, showing more interest in <a href="https://www.cryptopolitan.com/ai-hackers-defi-smart-contracts-showdown/" rel="noopener noreferrer nofollow">AI-assisted hacks</a> and targeting liquidity accumulation in DeFi protocols and specific vaults.&nbsp;
<figure style="width: 100%" class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/09/HacksSep152026.png" alt="Gnosis wallet exploited for $7.8M, Kelp DAO freezes the funds" width="1104" height="395">
 <figcaption>
 Web3 hacks accelerated in September, already surpassing the levels from August. The recent exploit is the largest Web3 hack for the month. | Source: <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">DeFi Llama</a>
 </figcaption>
</figure>
In September to date, a total of $326M was hacked, according to DeFi Llama data. Most of the <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">attacks and exploits</a> were under $1M, making the recent wallet exploit the biggest Web3 hack for September to date.&nbsp;
<h3 id="span-style-font-weight-400-how-was-the-gnosis-wallet-hacked-span">How was the Gnosis wallet hacked?</h3>
The recent exploit involved a wrapped form of rsETH, which was then transformed into ETH and moved on-chain. The series of transactions showed the initial attacker and the MEV bot completed the transfers in a single block.&nbsp;
<figure style="width: 100%" class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/09/rsETHexploitSep152026.png" alt="Gnosis wallet exploited for $7.8M, Kelp DAO freezes the funds" width="850" height="426">
 <figcaption>
 The initial attacker moved rsETH out of the wallet’s vault, but the MEV bot Yoink took all the rsETH, ending up in one destination address. | Source: <a href="https://etherscan.io/tx/0x0e7680b06cb8a6f86c149d9ba90d98e3d334e7b072dde03909d43fcfd98a8705" rel="noopener noreferrer nofollow">Etherscan</a>
 </figcaption>
</figure>
The initial wallet held leveraged rsETH in a Gnosis Safe, which authorized a whitelisted Safe module as a strategy executor to automate DeFi earnings. The trusted module turned out to be the entry point of the attack. A caller could exploit the Safe module with no extra authorization, since it was already whitelisted.&nbsp;
What makes the attack even more complex is that the MEV bot Yoink <a href="https://app.blocksec.com/phalcon/explorer/tx/eth/0x0e7680b06cb8a6f86c149d9ba90d98e3d334e7b072dde03909d43fcfd98a8705" rel="noopener noreferrer nofollow">front-ran</a> the exploiter and took the ETH in the same block. The bot front-ran the withdrawal of ETH from rsETH, where the funds still remain in the form of <a href="https://etherscan.io/address/0xC70f00CD7E461686b04B0E912E309becA8b80ea0#tokentxns" rel="noopener noreferrer nofollow">rsETH</a>. The bot’s destination address now contains only 44 ETH.&nbsp;
<h3 id="span-style-font-weight-400-are-other-protocols-affected-by-the-exploit-span">Are other protocols affected by the exploit?</h3>
The bot’s destination address was flagged by <a href="https://x.com/KelpDAO/status/2099740756865159562" rel="noopener noreferrer nofollow">Kelp DAO</a>, leading to a freeze of all the deposited rsETH. KelpDAO announced the address would be frozen as a precaution to prevent further losses.&nbsp;
<blockquote>
 Out of an abundance of caution, we’ve placed that address under a temporary 24-hour pause. During this window, rsETH cannot move in or out of it.
 We’re working closely with security experts to investigate and resolve this as quickly as possible. This is a precautionary, wallet-level measure only, announced Kelp DAO.
</blockquote>
During the latest exploit, Kelp DAO so far avoided losses, stating all its vaults were safe. Previously, Kelp DAO lost <a href="https://www.cryptopolitan.com/aave-liquidates-hacker-kelp-dao-exploit/" rel="noopener noreferrer nofollow">$292M</a> in rsETH, also affecting Aave vaults. The latest exploit is a rare case of intercepting the funds before being bridged to ETH and laundered through a mixer.&nbsp;
At this point, the Yoink bot served as an inadvertent white hat hacker, salvaging the funds and allowing Kelp DAO to freeze the destination address. The activity of the Yoink bot, however, does not guarantee the return of the rsETH.&nbsp;
As of September 15, rsETH traded at <a href="https://www.coingecko.com/en/coins/kelp-dao-restaked-eth" rel="noopener noreferrer nofollow">$2,663.68</a>. However, Kelp DAO also suspended deposits and withdrawals to prevent the attacker or the bot from moving the funds out of the ecosystem. 
The DAO already has a precedent with the previous hack, where a vote could revert some of the stolen funds. So far, the destination address has been blocked for 24 hours until a decision is made on clawing back the funds.&nbsp;
Recently, Kelp DAO managed to recover its value locked to <a href="https://defillama.com/protocol/kelp" rel="noopener noreferrer nofollow">$1.06B</a>&nbsp;after months of struggle following the recent exploit. The overall DeFi and lending recovery, with more funds available in vaults, may lead to more Web3 attacks against vulnerable contracts.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">It's free</a>.

Kelp DAO suspends deposits and withdrawals as Gnosis wallet suffers $7.8M exploit

Table of Contents

Cryptopolitan_News

Other articles published on Sep 15, 2026

Join our free newsletter for daily crypto updates!