$7.8M Wallet Nearly Drained by Attacker Outbid by MEV Bot

A $7.8 million Ethereum wallet was almost drained by an attacker on September 15, but a bot called Yoink spotted the exploit and stole the payout first.

The attack targeted an Ethereum Safe holding around 2,900 rsETH, Kelp DAO's liquid restaking token. A custom helper contract authorized to interact with the Safe contained a faulty authorization check that allowed an unauthorized caller to make malicious instructions appear trusted.

The attacker attempted to drain $7.8 million from the wallet but was outbid by Yoink, which paid around $46,000, $47,000 to secure priority execution and execute its own transaction first. As a result, the original attacker's main transaction failed to secure the funds.