$7.73M Stolen from Ethereum User's Wallet via Custom Module Hack

A hacker has exploited an Ethereum user's Safe wallet to steal approximately $7.73 million in rsETH, highlighting the risks of custom modules and malicious hooks in DeFi.

The attack occurred on September 15, with security monitoring identifying two transactions responsible for the loss. The hacker used a public keeper multicall to invoke a custom Uni V4 LP Safe module attached to the account, directing liquidity into an attacker-controlled Uniswap v4 pool created with a malicious hook.

The hook then converted the victim's aEthrsETH position into transferable rsETH, allowing the attacker to extract the underlying assets. The Safe module architecture allows authorized extensions to execute transactions independently from the normal multisignature flow, which in this case was exploited by the hacker.