Ethereum Wallet Loses $7.8 Million in rsETH Exploit

An Ethereum wallet holding leveraged rsETH has lost around $7.8 million after an attacker exploited a custom Safe module linked to a Uniswap v4 liquidity pool. The incident happened on September 15, 2026, but security researchers said the attack did not come from a flaw in Kelp DAO’s core rsETH contracts.

Here’s how the exploit actually happen.

Custom Safe Module Exposed Wallet to Attack

Blockchain security firm Blockaid identified the attack and traced it to a custom Uniswap v4 LP Safe module used by the affected Gnosis Safe wallet.

The wallet at 0x40E93…7AbA8 held about $7.73 million worth of rsETH before the attack.

According to the security analysis, the module had a public entry point that accepted caller-controlled data and used DELEGATECALL without proper access checks. 

Because the module was already authorized by the Safe, an outside attacker could use that entrypoint to execute code inside the wallet’s own context.

This gave the attacker control over the wallet’s assets.

How rsETH Exploit Happen?

The attacker first used a public keeper multicall function to redirect the wallet’s custom Uniswap v4 Safe module toward a malicious Hook pool.

The module then unpacked the wallet’s aEthrsETH, an Aave-wrapped version of restaked ETH, into raw rsETH. The attacker attempted to extract those tokens through the malicious pool.