{
 "tag": "blockaid",
 "name": "Blockaid",
 "group": "Other",
 "incidents": [
  {
   "slug": "safe-module-authorization-abuse-rseth-sep-2026",
   "title": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026",
   "json": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": null,
   "product": "A user's Safe multisig with a custom Uniswap v4 liquidity module",
   "tags": [
    "ethereum",
    "safe",
    "multisig",
    "safe-module",
    "uniswap-v4",
    "multicall",
    "rseth",
    "kelp-dao",
    "mev",
    "blockaid"
   ],
   "amountUsd": 7800000,
   "victims": 1,
   "startedAt": "2026-09-15",
   "closedAt": null,
   "updatedAt": "2026-09-15T12:00:00Z",
   "summary": "On 15 September 2026 an attacker abused a custom Uniswap v4 liquidity module and a Multicall helper that an Ethereum Safe multisig owner had approved, pointing the wallet's position at a malicious pool and unwrapping about 2,882 rsETH (around $7.8M). Blockaid described it as abuse of module permissions on that one Safe, not a bug in Safe itself or a stolen owner key. MEV bot Yoink front-ran the attacker and took the funds, Kelp DAO froze that address within about two hours, and whether the funds come back is unresolved. Safe owners should audit every enabled module."
  },
  {
   "slug": "wasabi-protocol-deployer-key-apr-2026",
   "title": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
   "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026",
   "json": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum",
    "base"
   ],
   "method": "key-leak",
   "product": "Wasabi Protocol vaults and LP holders (Ethereum, Base)",
   "tags": [
    "ethereum",
    "base",
    "key-leak",
    "wasabi-protocol",
    "admin-key",
    "deployer-key",
    "proxy-upgrade",
    "perps",
    "blockaid"
   ],
   "amountUsd": 4550000,
   "victims": null,
   "startedAt": "2026-04-30",
   "closedAt": "2026-04-30",
   "updatedAt": "2026-04-30T12:00:00Z",
   "summary": "On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts."
  }
 ],
 "changes": [
  {
   "incident": "safe-module-authorization-abuse-rseth-sep-2026",
   "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-15",
   "title": "At 04:38 UTC the attacker used the approved module to unwrap the Safe's aEthrsETH into about 2,882 rsETH; Blockaid flagged the theft.",
   "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026"
  },
  {
   "incident": "safe-module-authorization-abuse-rseth-sep-2026",
   "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-15",
   "title": "MEV bot Yoink front-ran the exploit by paying the block builder about $46,000, and Kelp DAO froze the receiving address within about two hours.",
   "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026"
  },
  {
   "incident": "wasabi-protocol-deployer-key-apr-2026",
   "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-30",
   "title": "The attacker used the compromised wasabideployer.eth key to call grantRole and give themselves admin privileges with no delay.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise",
   "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026"
  },
  {
   "incident": "wasabi-protocol-deployer-key-apr-2026",
   "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-30",
   "title": "A helper contract upgraded the perp vaults and Long Pool to malicious implementations that drained balances on Ethereum and Base; Blockaid flagged the exploit on X.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise",
   "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026"
  }
 ]
}