{
 "tag": "multicall",
 "name": "Multicall",
 "group": "Other",
 "incidents": [
  {
   "slug": "safe-module-authorization-abuse-rseth-sep-2026",
   "title": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026",
   "json": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": null,
   "product": "A user's Safe multisig with a custom Uniswap v4 liquidity module",
   "tags": [
    "ethereum",
    "safe",
    "multisig",
    "safe-module",
    "uniswap-v4",
    "multicall",
    "rseth",
    "kelp-dao",
    "mev",
    "blockaid"
   ],
   "amountUsd": 7800000,
   "victims": 1,
   "startedAt": "2026-09-15",
   "closedAt": null,
   "updatedAt": "2026-09-15T12:00:00Z",
   "summary": "On 15 September 2026 an attacker abused a custom Uniswap v4 liquidity module and a Multicall helper that an Ethereum Safe multisig owner had approved, pointing the wallet's position at a malicious pool and unwrapping about 2,882 rsETH (around $7.8M). Blockaid described it as abuse of module permissions on that one Safe, not a bug in Safe itself or a stolen owner key. MEV bot Yoink front-ran the attacker and took the funds, Kelp DAO froze that address within about two hours, and whether the funds come back is unresolved. Safe owners should audit every enabled module."
  },
  {
   "slug": "usdt-approval-phishing-999999-jul-2026",
   "title": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026",
   "json": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "approval-phishing",
   "product": "Ethereum USDT holder",
   "tags": [
    "ethereum",
    "approval-phishing",
    "usdt",
    "scam-sniffer",
    "multicall",
    "drainer"
   ],
   "amountUsd": 999999,
   "victims": 1,
   "startedAt": "2026-07-08",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance."
  }
 ],
 "changes": [
  {
   "incident": "safe-module-authorization-abuse-rseth-sep-2026",
   "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-15",
   "title": "At 04:38 UTC the attacker used the approved module to unwrap the Safe's aEthrsETH into about 2,882 rsETH; Blockaid flagged the theft.",
   "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026"
  },
  {
   "incident": "safe-module-authorization-abuse-rseth-sep-2026",
   "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-15",
   "title": "MEV bot Yoink front-ran the exploit by paying the block builder about $46,000, and Kelp DAO froze the receiving address within about two hours.",
   "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026"
  },
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "Scam Sniffer posted an alert about the loss.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-08",
   "title": "The victim signed a phishing token approval and the attacker pulled 999,999 USDT out in three transactions using multicalls.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  }
 ]
}