An MEV bot named yoink front-ran an exploit targeting rsETH holders on Ethereum on Sept. 15, intercepting a $7.8 million theft before the attacker could withdraw it. The bot detected the malicious transaction in the mempool, executed its own transaction ahead of the exploit, and captured the full amount that the attacker had aimed to steal.
The underlying attack exploited a custom Uniswap v4 Safe module to drain an rsETH holder's wallet. rsETH is Kelp DAO's liquid restaking token, which represents Ethereum staked through EigenLayer's restaking protocol. The compromised strategy executor triggered the drain, but the MEV bot's front-run intervention meant the attacker never received the funds.
MEV bots continuously scan the Ethereum mempool for pending transactions they can profit from by reordering, inserting ahead of, or racing to execute transactions first. In this case, yoink's automation detected the exploit transaction before it settled and constructed a competing transaction that claimed the $7.8 million in rsETH, approximately 2,882 tokens at the time, as its own MEV spread. The bot then submitted its transaction at a higher gas price, ensuring it executed first.
The incident occurred as exploits targeting liquid staking derivatives have increased throughout 2026. Kelp DAO's rsETH bridges liquidity between Ethereum staking and EigenLayer's restaking ecosystem, creating a surface for both protocol-level bugs and wallet-level attacks. Blockaid's alert identified the compromise on Sept. 15 UTC 04:38.
MEV extraction typically harms regular users by enabling front-running of their swaps or liquidations. In this case, the MEV extraction prevented the attacker from profiting, though it did not return funds to the compromised wallet holder. The yoink bot retained the $7.8 million as compensation for executing its transaction first.
The scale of the capture, $7.8 million in a single mempool front-run, exceeds most sandwich attacks on routine user swaps, where MEV bots typically extract thousands of dollars per transaction. This magnitude comes from both the size of the attack and the speed at which automated systems detected and acted on the opportunity.
The mechanism by which yoink identified and intercepted the exploit remains the most efficient protection available to Ethereum users in real time. Wallet security and exploit detection services can alert users to threats, but only MEV bots operating in the mempool can preempt attacks by executing competing transactions. If Kelp DAO or Safe module developers do not patch the underlying vulnerability that allowed the strategy executor to be compromised, similar exploits may recur.
