Safe Wallet Loses $7.73M in rsETH After Malicious Uniswap v4 Hook Route

Approximately 2,900 rsETH, valued at about $7.73 million, was removed from Safe wallet 0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8 at 04:38:47 UTC on September 15 in a transaction involving a malicious Uniswap v4 hook route, according to the on-chain record on Etherscan.

Blockaid said a public keeper multicall routed an authorised custom Uniswap v4 LP Safe module into an attacker-created hooked pool, whose hook converted aEthrsETH into transferable rsETH. The reported account characterised the incident as a permissions issue involving a custom module rather than an apparent compromise of the wallet’s owners; Defimon Alerts said the MEV bot Yoink captured the extracted rsETH in the same block.

Keeper multicall and hook route

Blockaid’s reconstruction, cited by The Crypto Times, described a public keeper multicall and an authorised custom Uniswap v4 LP Safe module being routed into an attacker-created hooked pool.

The hook converted aEthrsETH into transferable rsETH.

The multicall was public, and the invoked LP module was already authorised, allowing the call to be directed toward the attacker-created pool. Defimon Alerts reported that Yoink captured the extracted rsETH in the same block; it identified 0xC70f00CD7E461686b04B0E912E309becA8b80ea0 as the recipient of the main proceeds.

Delegated authorization, not a reported core compromise

Defimon Alerts reported that Yoink took the extracted rsETH in the same block. It identified 0xC70f00CD7E461686b04B0E912E309becA8b80ea0 as the address receiving the main proceeds.

The incident was attributed to unsafe delegated-module authorisation, rather than a reported compromise of Safe core contracts, wallet owner keys or the rsETH protocol. Safe’s documentation says modules form part of its smart-account architecture and can let authorised components extend an account’s execution capabilities; the documentation is available here.

On that account, the reported failure point was the permissions and execution route around the custom module, not the underlying Safe wallet system or rsETH protocol.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.