MEV Bot Yoink Front-Runs Hacker, Intercepts 2,882 rsETH

According to CoinDesk, an attacker exploited a permission validation flaw in the Multicall contract authorized by Safe multi-signature wallets, attempting to transfer approximately 2,900 rsETH (about $7.8 million). However, automated trading bot Yoink detected the transaction in the public trading pool, paid approximately $47,000 in fees to front-run the transaction, intercepted 2,882 rsETH, and transferred them to another address. BlockSec, Blockaid, SlowMist, and AstraSec all confirmed that the vulnerability lies in user-authorized components, not in Safe's core contracts. Kelp DAO, the issuer of rsETH, has implemented a 24-hour pause on the receiving address.