September's biggest Web3 exploit accounts for 2.4% of the month's DeFi losses
A Gnosis Safe lost $7.73M in rsETH on September 15 through an automation module its own owner had whitelisted, an MEV bot took the proceeds in the same block, and Kelp DAO froze the destination address for 24 hours.
The Investor · Invest desk
What happened
- An unidentified Gnosis Safe wallet was drained in a single transaction on September 15, losing the equivalent of 2,153 ETH in rsETH that was then split across multiple wallets.
- The MEV bot Yoink front-ran the exploiter's withdrawal of ETH from rsETH and took the proceeds in the same block, leaving the loss stranded in rsETH rather than bridged ETH.
- Kelp DAO froze the deposited rsETH at the bot's destination address and suspended deposits and withdrawals to stop either party moving funds out of the ecosystem.
- Decentralized hacks and exploits for September to date have already passed the total for all of August.
Why it matters
- Who's exposed exposure Any Safe owner who has whitelisted an automation module as a strategy executor is reachable by whoever can call it, because the authorization was granted once and does not check the caller again.
- What it limits constraint Recovery here rests on a token issuer's ability to freeze an address and on an MEV operator's goodwill, neither of which is a contractual claim the wallet owner can enforce.
- Who has to decide decision An allocator sizing DeFi operational risk from headline exploits is pricing 2.4% of September and ignoring the rest, so the unit of measurement has to be incident frequency per protocol.
- What doesn't add up contradiction The loss can be booked at $7.73M or at about $5.73M depending on which of the source's own figures is used, a $2M spread on a single transaction.
Next story · Invest · yesterday
A double-counted share reduction let an attacker pull $86,000 from UNCX's shared vesting poolConfirmed2 publishers
Take the single largest event out of DeFi Llama's September count and $318.3M is left, and because most of the month's recorded attacks came in under $1M each, reaching that remainder takes more than 318 separate incidents [18][13]. The $7.73M drained from one Gnosis Safe wallet is the biggest Web3 hack of the month to date and 2.4% of its total [13][17].
The owner had granted the entry point on purpose. The Safe held leveraged rsETH and had authorized a whitelisted Safe module as a strategy executor to automate DeFi earnings, and because the module was already whitelisted, a caller could use it without any further authorization [3]. Kelp DAO said all its vaults were safe [9].
The value stayed in rsETH on the main chain. The initial transaction shows the funds parked in rsETH without being swapped [12], and the 44 ETH sitting in the bot's destination address is about 2% of the 2,153 ETH the wallet lost [5][11][20]. Kelp DAO flagged that address. "Out of an abundance of caution, we've placed that address under a temporary 24-hour pause. During this window, rsETH cannot move in or out of it," Kelp DAO said [7].
Two figures for this loss are in circulation. Blockaid put the loss at $7.73M [1]; 2,153 units at the $2,663.68 rsETH price quoted for September 15 come to about $5.73M, roughly $2M less [11][15][19]. The account leaves both numbers standing. An allocator has to choose which of the two it is underwriting.
Whether any of it comes back is a governance question, and Kelp DAO has been here before: after a $292M rsETH loss that also hit Aave vaults, a vote could revert some of the stolen funds [23][24]. This one is 0.73% of the $1.06B Kelp has recovered in value locked [16][21]. The pause runs 24 hours while a decision is made on clawing back the funds, and the report is explicit that the bot's activity does not guarantee the rsETH is returned [24][10].
I would expect a partial recovery through that same freeze-and-vote route, and I would expect October to look like September: a run of small losses with one visible outlier. The counter-thesis is that the size distribution is moving, since the same account has exploits accelerating over three months with more interest in AI-assisted attacks and in the liquidity accumulating in specific vaults [25]. Two other paths: the pause lapses without a vote and the rsETH moves, or Yoink's operator keeps the 44 ETH [5]. What would break the frequency read is a month where one exploit is a third of the total [17].
What to watch
- Whether the 24-hour pause is extended, allowed to lapse, or converted into a governance vote on clawing back the rsETH.
- Whether Yoink's operator returns the rsETH or moves the 44 ETH sitting in the flagged destination address.
- DeFi Llama's final September total, and whether the month stays composed mostly of sub-$1M events.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption48
- Hype gap+35
- Incentives62
- Confidence52
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A Gnosis Safe wallet was exploited for close to $7.8M in rsETH; the wallet was exploited for $7.73M in rsETH, according to Blockaid data.
- [2]
The attack was registered on September 15 against a Gnosis Safe wallet user who has not yet been identified.
- [3]
The initial wallet held leveraged rsETH in a Gnosis Safe that authorized a whitelisted Safe module as a strategy executor to automate DeFi earnings; the trusted module was the entry point of the attack, and a caller could exploit it with no extra authorization since it was already whitelisted.
- [4]
The MEV bot Yoink front-ran the exploiter and took the ETH in the same block, front-running the withdrawal of ETH from rsETH, where the funds still remain in the form of rsETH.
- [5]
The bot's destination address now contains only 44 ETH.
- [6]
The bot's destination address was flagged by Kelp DAO, leading to a freeze of all the deposited rsETH, announced as a precaution to prevent further losses.
- [7]
"Out of an abundance of caution, we've placed that address under a temporary 24-hour pause. During this window, rsETH cannot move in or out of it," Kelp DAO said.
- [8]
"We're working closely with security experts to investigate and resolve this as quickly as possible. This is a precautionary, wallet-level measure only," Kelp DAO said.
- [9]
During the latest exploit Kelp DAO so far avoided losses, stating all its vaults were safe.
- [10]
The Yoink bot served as an inadvertent white hat hacker, salvaging the funds and allowing Kelp DAO to freeze the destination address, but its activity does not guarantee the return of the rsETH.
- [11]
The wallet was drained in a single transaction, taking away the equivalent of 2,153 ETH, which was later split and moved across multiple wallets.
- [12]
The initial transaction shows the funds were finally parked in rsETH, without being swapped into ETH on the main chain for further laundering.
- [13]
In September to date a total of $326M was hacked, according to DeFi Llama data; most of the attacks and exploits were under $1M, making the recent wallet exploit the biggest Web3 hack for September to date.
- [14]
For September to date, decentralized hacks and exploits already surpass the level for the whole of August.
- [15]
As of September 15, rsETH traded at $2,663.68.
- [16]
Kelp DAO recently managed to recover its value locked to $1.06B after months of struggle following the recent exploit.
- [17]
The $7.73M exploit is about 2.4% of the $326M hacked in September to date.
- [18]
Excluding the $7.73M exploit, about $318.3M of September's total came from other events; at under $1M each, that is more than 318 separate incidents.
- [19]
2,153 units at the quoted rsETH price of $2,663.68 come to about $5.73M, roughly $2M below the $7.73M loss figure.
- [20]
The 44 ETH in the flagged destination address is about 2% of the 2,153 ETH equivalent drained from the wallet.
- [21]
The $7.73M loss is about 0.73% of Kelp DAO's $1.06B in value locked.
- [22]
Kelp DAO suspended deposits and withdrawals to prevent the attacker or the bot from moving the funds out of the ecosystem.
- [23]
Kelp DAO previously lost $292M in rsETH, a loss that also affected Aave vaults.
- [24]
Kelp DAO already has a precedent from the previous hack, where a vote could revert some of the stolen funds; the destination address has been blocked for 24 hours until a decision is made on clawing back the funds.
- [25]
In the past three months, exploits have accelerated from their lows, showing more interest in AI-assisted hacks and targeting liquidity accumulation in DeFi protocols and specific vaults.
Sources
2 independent publishers whose own reporting we read for this story.
- cointelegraph.comETH wallet exploit backfires as MEV bot captures $7.7M, Kelp freezes address
1 article · September 15, 2026
- cryptopolitan.comKelp DAO suspends deposits and withdrawals as Gnosis wallet suffers $7.8M exploit
1 article · September 15, 2026
Topics and entities
Topics
- Smart Contract Wallets
- DeFi Security
- Liquid Restaking
- MEV