Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingMEV机器人拦截提取：rsETH安全事件始末与复盘
一起针对以太坊安全钱包（Ethereum Safe）中价值约 770 万美元 rsETH 资产的提取尝试，因被 MEV（最大可提取价值）机器人拦截而未能得逞。区块链安全公司 Blockaid 指出，该事件始于受害者钱包附加的一个恶意自定义模块，该模块将流动性重定向至一个旨在兑换为 rsETH 的特定设置中。
据 Blockaid 报告，约有 773 万美元的 rsETH 在攻击中被盗取。然而，一个独立的自动化实体抢先捕获了这些代币，随后 rsETH 协议运营商 Kelp 对接收地址实施了为期 24 小时的暂停操作。
关键要点
- 初始损失原因： Blockaid 将初始损失归因于连接至以太坊安全钱包的自定义模块，该模块用于将代币路由至挂钩 Uniswap v4 的恶意流动性池中。
- MEV 机器人介入： 一个名为 “Yoink” 的 MEV 机器人抢跑了攻击者的操作，在攻击者控制资金之前先一步获取了 rsETH。
- Kelp 的响应： Kelp 在接收地址层面实施了 24 小时暂停，并声明 rsETH 仍有足额储备，其核心合约未受影响。
- 运营正常： 据报道，在调查期间，铸造、提现和集成服务均正常运行。
从 Safe 到 rsETH 的提取尝试是如何运作的
Blockaid 在其报告中描述了一条利用以太坊安全钱包模块系统的 exploit 路径。攻击者使用公开的 “keeper multicall” 调用与受害者 Safe 关联的自定义 Uniswap v4 流动性模块，将资金引导至由攻击者创建的流动性环境中。
该受攻击者控制的池子配置为可以将 aEthrsETH 兑换为 rsETH，从而有效地将路由头寸转换为攻击者意图提取的代币。Blockaid 确认受影响的钱包属于一名不明用户，并在其初步更新中表示，当时的 rsETH 损失约为 773 万美元。
Blockaid 的文章还将更广泛的事件与 Etherscan 上的特定链上交易联系起来，其中资产的后续流动展示了此次试图流出资金的经过。
改变结果的 MEV 机器人
并没有让原始攻击者接管 rsETH 的控制权，而是被称为 “Yoink” 的 MEV 机器人率先介入。正如 Blockaid 所述，Yoink 监控区块链交易以寻找有利可图的机会，在此案例中，它抢跑了需要捕获代币控制权的关键步骤。
Blockaid cited Etherscan transaction data to show that Yoink transferred approximately 18.93 ETH (approximately US$46,000 at the time the observed conversion occurred) to an address labeled "block builder" in the same transaction. Although these data involve subsequent transfers by the robot rather than the initial rsETH amount, they suggest that the MEV opportunity was executed quickly after the exploit transaction entered the memory pool.
From a practical perspective, the MEV rush does not "prevent" the exploit's attempted construction; instead, it redirects settlement results by capturing assets before the attacker completes the expected withdrawal path.
Kelp's response: Targeted suspension, not protocol closure
After the MEV robot intercepted the token, Kelp, the protocol behind rsETH, implemented a 24-hour pause on the addresses where funds were received. The move aims to temporarily prevent transfers from the destination while allowing security experts to conduct investigations.
Kelp said the measure was a wallet/address level precautionary measure and emphasized that the contracts of the agreement itself were not affected components. In a statement posted on X (formerly Twitter), Kelp described the suspension as a "precautionary wallet-level measure only" and added that rsETH "still has sufficient reserves."
What is important for holders is that Kelp also shows continuity of operations: as the survey progresses, casting, withdrawal and integration are proceeding normally. The wording of the agreement states that any exposure to risks is limited to the exploited Safe/Module path, not systemic contract vulnerabilities.
尚存的不确定性——投资者应关注什么
基于 Blockaid 的描述和 Kelp 的回应，该事件的核心在于攻击者利用连接至特定 Safe 的自定义模块，而 Kelp 坚称其核心合约未受侵害。即使有了这种 reassurance（安心保证），这一事件也凸显了 Safe 模块权限可能成为一个关键的控制系统表面：如果启用了恶意模块，或者钱包被诱骗执行恶意的 multicall，资产可能会被路由至非标准流程中。
随着 Kelp 的 24 小时暂停窗口成为当前的时间焦点，接下来的问题是：暂停的地址能否被安全回收？是否有其他地址或交易与同一 exploit 链相关联？以及类似基于模块的模式是否在其他地方出现。追踪 rsETH 的读者还应关注 Kelp 和安全研究人员发布的关于事后分析的任何更新，以及对 Safe/模块运营商的任何指导方针。
