The $7.8 million the Yoink bot took from a hacker went back to the Safe’s owner
PublicAML · On-chain investigation · 24 September 2026
On 15 September 2026 an attacker found a hole in a custom module attached to a Safe holding 2,900 rsETH, and an MEV bot called Yoink copied the transaction and got there first. The story stopped there: a bot holding $7.8 million, Kelp DAO pausing its address for 24 hours, the owner’s fate unknown. The chain has the ending. About thirty hours later, once the pause was over, the bot’s wallet sent every rsETH it had received — 2,882.37 — to an owner of the drained Safe: one as a test, then the rest twelve minutes later.
2,882.37 rsETH
returned to an owner of the drained Safe, 16 Sep
100%
of what reached the bot’s wallet — nothing kept back
17.63 rsETH
spent inside the interception itself, to pay for the block position
~30 h
from interception to return, after Kelp’s 24-hour pause
What happened
The Safe kept its rsETH in Aave. A module the owner had installed trusted a public keeper call more than it should have, and on 15 September someone built a transaction that used it to pull the position out. That transaction sat in the public mempool long enough for Yoink, an MEV bot, to copy it and outbid it: at 04:38:47 UTC the bot’s version ran first and the 2,900 rsETH went to the bot instead of the attacker. Part of it, 17.63 rsETH, was swapped inside the same transaction to pay for the block position; 2,882.3674 rsETH landed on the bot’s wallet, 0xC70f00CD7E461686b04B0E912E309becA8b80ea0. Kelp DAO then paused that address for 24 hours.
| When (UTC, 2026) | From | To | Amount | Tx |
|---|---|---|---|---|
| 15 Sep 04:38:47 | 0x40E93a…f7AbA8 | 0x80BF7D…BBD4e4 | 2,900 rsETH (from Aave) the interception, out of the Safe’s Aave position | 0x0e7680…8a8705 |
| 15 Sep 04:38:47 | 0x80BF7D…BBD4e4 | 0xC70f00…b80ea0 | 2,882.3674 rsETH to the bot’s wallet | 0x0e7680…8a8705 |
| 16 Sep 10:26 | 0xC70f00…b80ea0 | 0x8c2AEc…78FEe8 | 1 rsETH test transfer to a Safe owner | 0x03d314…7c9ac7 |
| 16 Sep 10:38 | 0xC70f00…b80ea0 | 0x8c2AEc…78FEe8 | 2,881.3674 rsETH the rest, twelve minutes later | 0xe1615c…120c6e |
Where it went
At 10:26 UTC on 16 September the bot’s wallet sent 1 rsETH to 0x8c2AEcCef3B3634D039c96993577F80D3278FEe8. At 10:38 it sent the rest, 2,881.3674 rsETH. Together that is exactly what the wallet had received from the interception.
The recipient is one of three owners of the Safe that was drained, 0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8 — the Safe emitted events inside the exploit transaction, and its owner list, read from the Safe Transaction Service, includes this address. On 18 September the owner moved the rsETH through the Safe and back; it is still with them.
Within minutes of the return, zero-value transfers to look-alike addresses beginning 0x8c2a started appearing in the bot wallet’s history — address poisoning by third parties hoping one of them copies the wrong address next time.
What it means
This is a recovery, not a theft: the owner lost the cost of the block position and nothing else, and the attacker got nothing but dust. Neither the bot nor the owner is accused of anything, and none of the addresses on this page is labelled as risky. What remains open is the attacker who found the hole; the reports say they came back an hour later for the dust.
Sources: Ethereum chain data (Blockscout) and the Safe Transaction Service, read on 24 September 2026; the interception and Kelp DAO’s 24-hour pause as reported on 15–21 September. This is an information resource about transactions between addresses, not financial or legal advice, and it names no individual as responsible for anything.