MEV robot Yoink intercepted a hacker and took away 2882 rsETH

According to CoinDesk, an attacker exploited a permission verification flaw in the Multicall contract authorized by the Safe multi-signature wallet, attempting to transfer approximately 2,900 rsETH (about 7.8 million USD). However, the automated trading bot Yoink discovered the transaction in the public trading pool, paid about 47,000 USD in fees to execute the transaction first, intercepted 2,882 rsETH, and transferred it to another address.

BlockSec, Blockaid, Slow Mist, and AstraSec have all confirmed that the vulnerability lies in the components authorized by the user, rather than the core Safe contract. The issuer of rsETH, Kelp DAO, has implemented a 24-hour suspension on the receiving address.