A crypto wallet hack on Ethereum turned a routine automation setup into a $7.8 million loss, exposing how a trusted helper contract can become the weakest link.
The attacker took roughly 2,900 rsETH from a Gnosis Safe wallet on Tuesday, according to security firms BlockSec, Blockaid and SlowMist. The theft did not come from a failure in Safe’s core contracts, but from another contract the wallet owner had authorized to move funds.
The setup itself was unremarkable. Wallets can delegate certain actions to helper contracts when users want to automate trading or other on-chain activity.
The problem was the permission check.
The helper contract was supposed to confirm that whoever called it actually had the right to move the wallet’s assets. Instead, investigators found that the check could approve a request if the attacker simply identified the helper contract itself as the target.
That tiny piece of logic was enough to open the door.
The crypto wallet hack hid inside a trusted shortcut
Once the attacker found the flaw, the stolen rsETH was moved into a trading pool created only minutes earlier. The pool paired the asset with a worthless token called Permissionless Attacker Token.
The move effectively turned nearly $7.8 million worth of rsETH into a receipt backed by something with no value.
Then the transaction queue became part of the story.
An automated bot known as “yoink” front-ran the attack transaction, paying roughly $47,000 to get ahead of it. The bot ultimately captured the tokens, with about 2,882 rsETH sent to a separate address.
In other words, the exploit was not just about finding a coding mistake. It was also about navigating the competitive mechanics of Ethereum fast enough to profit from it.
AstraSec identified the underlying issue as a failure in the authorization logic of the Multicall contract. Other security firms reached the same broad conclusion: the vulnerable component was one the wallet owner had chosen to trust, rather than Safe’s own core contracts.
That distinction matters because a crypto wallet hack does not necessarily mean the wallet software itself has been compromised.
In this case, the attack demonstrates a more uncomfortable reality of smart-contract security. A wallet can rely on a carefully designed core system and still be exposed by an auxiliary contract operating with legitimate permissions.
The risk is especially easy to overlook when the vulnerable component is there for convenience. Automation can reduce friction, but every additional contract with permission to act on a wallet introduces another piece of code that has to get its assumptions exactly right.
Kelp DAO, the issuer of rsETH, said its own contracts remain secure and that rsETH is fully collateralized. After detecting suspicious activity involving an address that had received rsETH, the protocol also placed that address under a temporary 24-hour pause.
During that period, rsETH could not move in or out of the affected address.
The incident leaves behind a lesson that is less dramatic than a spectacular protocol failure, but potentially more useful: in crypto, security often depends on the small contracts users barely think about.
A crypto wallet hack can begin with something as ordinary as an automation tool, then cascade through permissions, transaction ordering and on-chain markets within minutes. The expensive part may be the stolen asset. The revealing part is how little code it took to make the theft possible.