MEV Bot Yoink Intercepts $7.8M rsETH Exploit on Ethereum

An automated MEV bot known as Yoink intercepted a $7.8 million exploit targeting a user’s rsETH holdings on the Ethereum network, effectively front-running the attacker to capture the assets [1]. The incident highlights the role of Maximal Extractable Value (MEV) bots, which monitor blockchain transactions for profitable opportunities, in the broader security landscape of decentralized finance [2].

The mechanics of the interception

The exploit originated from a custom module connected to the victim’s Safe, a smart contract wallet, rather than a vulnerability within the Kelp protocol itself [1]. As the attacker attempted to move the rsETH, the Yoink bot identified the transaction and executed a front-running maneuver—a process where a bot pays higher gas fees to ensure its own transaction is processed before the target's [1]. By doing so, the bot captured the $7.8 million in rsETH before the original exploiter could take control of the funds [1].

Following the interception, Etherscan data revealed that the Yoink bot transferred approximately 18.93 ETH, valued at roughly $46,000, to an address identified as a block builder [1]. This payment is a common feature of MEV strategies, used to incentivize validators to prioritize the bot's transaction within a block [2].

Protocol response and security status

Kelp, the protocol behind the rsETH token, responded by placing the address that received the intercepted funds under a 24-hour pause [1]. The protocol stated that this was a precautionary, wallet-level measure intended to prevent the movement of the tokens while the situation is assessed [1].

Kelp has maintained that its core contracts remain secure and that rsETH is fully backed [1]. According to the protocol, standard operations including minting, withdrawals, and integrations are continuing to function normally while the team works with security experts to investigate the specific attack vector [1].

What to watch

• Asset Recovery: Monitor whether the address currently holding the $7.8 million in rsETH attempts to move the funds once the 24-hour pause imposed by Kelp expires.
• Protocol Updates: Watch for further disclosures from Kelp regarding the specific custom module that served as the entry point for the exploit, which may impact other users of similar wallet configurations.

The incident underscores the dual nature of MEV bots, which can act as both a source of market friction and, as seen here, a mechanism that can inadvertently disrupt malicious exploits. Whether the intercepted funds are returned to the original victim or remain with the bot operator remains an open question.