Kelp DAO Freezes Deposits After $7.8M Gnosis Wallet Exploit

A Gnosis Safe wallet was exploited on September 15 for roughly $7.73 million worth of rsETH, according to Blockaid data. The funds, equivalent to 2,153 ETH, were drained in a single transaction and split across multiple wallets, with the tokens kept as rsETH rather than converted to ETH for further laundering.

The attack targeted a whitelisted Safe module that had been trusted to automate DeFi strategy execution. Because the module was already authorised, an attacker was able to call it without needing extra permissions, turning a convenience feature into the entry point for the theft. Adding to the complexity, an MEV bot called Yoink front-ran the exploiter within the same block and captured much of the ETH before it could be withdrawn, though most of those funds remain locked as rsETH.

Kelp DAO flagged the bot's destination address and placed it under a temporary 24-hour pause, halting rsETH transfers in or out as a precaution. This is one of several large DeFi exploits this month, with total losses in September already exceeding $326 million across the sector, according to DeFi Llama.