MEV bot front-runs $7.81M rsETH exploit against Gnosis Safe wallet
Security & Exploits ·
A whale using a Gnosis Safe lost $7.73M after an MEV bot intercepted an attacker's own $7.81M rsETH exploit before the original attacker could claim the funds.
The exploit exploited a delegatecall vulnerability in an authorized module attached to the Gnosis Safe, a smart contract wallet setup commonly used to manage large token holdings. Rather than the original attacker walking away with the proceeds, an MEV bot identified as yoink front-ran the transaction and redirected the full $7.81M in rsETH to itself, according to on-chain activity tied to an Ethereum address associated with the incident.
The mechanics illustrate a recurring risk in DeFi security: even when an attacker successfully identifies and triggers a vulnerability, they are not guaranteed to keep the spoils. MEV bots continuously scan the mempool for profitable transactions and can copy or intercept an exploit mid-flight, effectively stealing from the thief. In this case, the delegatecall flaw in the Safe module allowed arbitrary code execution with the wallet's permissions, and the bot exploited that same opening a fraction of a second faster than the original attacker.
The Gnosis Safe whale's realized loss came in slightly lower than the headline exploit figure, at $7.73M, though the exact reason for the gap between the $7.81M drained and the $7.73M loss recorded for the victim has not been detailed. It is also not yet established what specific module or integration on the Safe carried the delegatecall vulnerability, nor whether other wallets using the same module configuration remain exposed.
The incident lands amid a broader period of stress for rsETH and its surrounding infrastructure, following the much larger $292M Kelp DAO bridge exploit that hit LayerZero-based cross-chain messaging earlier in the year and prompted protocols including Aave to freeze markets and Kelp DAO to plan a migration to Chainlink CCIP. Whether this separate Gnosis Safe incident is connected to that earlier bridge compromise, or is an unrelated exploit targeting rsETH-holding wallets, remains unconfirmed. Also unresolved is whether the MEV bot's proceeds will be returned, frozen, or otherwise recovered, and whether the underlying Safe module vulnerability has since been patched.