An attacker attempted to drain approximately $7.7 million worth of rsETH from an Ethereum Safe wallet by abusing a custom module tied to the wallet. Instead of successfully exiting with the funds, the operation was interrupted when an MEV bot captured the tokens first, according to blockchain security firm Blockaid.

Blockaid said the exploit used a public “keeper” multicall to route a custom Uniswap v4 liquidity module into an attacker-controlled hooked pool. In that setup, aEthrsETH was unwrapped into rsETH—allowing the attacker to try to take custody of the extracted tokens.

Key takeaways

• Blockaid traced the incident to a custom Uniswap v4 liquidity module connected to a Safe wallet.
• The attacker reportedly targeted rsETH holdings worth about $7.73 million, but an MEV bot intercepted the funds.
• On-chain activity indicates the MEV bot transferred rsETH out before the original exploiter could act.
• Kelp, the rsETH protocol, placed a 24-hour pause on the recipient address as a precaution while stating rsETH remains fully backed.
• Minting, withdrawals, and integrations were reported as continuing normally during the investigation.

From Safe module to attacker-controlled liquidity pool

In its report, Blockaid described a two-stage strategy. First, the attacker leveraged a Safe-related “keeper multicall” as a public execution path. Then, through that multicall, the attacker directed a custom Uniswap v4 liquidity module into a hooked pool created by the attacker.

The key mechanics, per Blockaid, were centered on converting aEthrsETH into rsETH inside the attacker’s pool. This effectively created a route for extracting rsETH from the victim wallet using functionality already wired into the Safe.

Blockaid identified the impacted wallet as belonging to an unidentified Safe user and estimated that roughly $7.73 million in rsETH was taken at the time of its initial reporting.

MEV bot “Yoink” front-runs the exploiter

Rather than letting the exploiter obtain control of the extracted rsETH, the transaction appears to have been front-run by an MEV bot named “Yoink.” MEV bots monitor mempool and transaction patterns to capture opportunities when transactions can be reordered for profit or advantage.

Blockaid said Yoink took the rsETH before the original attacker could secure the funds. Etherscan transaction data linked in Blockaid’s update indicates that Yoink transferred about 18.93 ETH—valued at roughly $46,000 at the time—during the same transaction to an address labeled as a “block builder.”

While this does not by itself clarify the bot’s full profit model, the pattern is consistent with MEV-style routing: the bot captures value in the reordered execution and settles or forwards funds through builder-related infrastructure.

Kelp pauses a receiving address; contracts reportedly safe

After the extraction and interception, the rsETH protocol behind Kelp moved to reduce the risk of further token movement from the implicated destination.

Kelp placed the address that received the funds under a 24-hour pause, temporarily preventing the tokens from being transferred. In an update posted on X, Kelp described the step as a precautionary, wallet-level measure only, adding that its own contracts are safe and that rsETH remains fully backed.

Kelp also said minting, withdrawals, and integrations were continuing normally while it worked with security experts to investigate what happened. In its explanation of the likely attack path, Kelp pointed to the custom module attached to the victim’s Safe as the apparent vector, while stating that Kelp’s core contract layer was unaffected.

What this incident signals for Safe and DeFi modularity

This case underscores how “legitimate” DeFi components can become high-risk when they are wired into wallet automation or custom modules. The exploit did not rely on a claimed vulnerability in Kelp’s contracts; instead, it leveraged a custom Uniswap v4 module and the Safe’s ability to execute preconfigured calls via a public multicall mechanism.

For users and teams operating smart-contract wallets, the lesson is less about any single protocol’s implementation and more about how modules are designed, approved, and monitored. When Safe wallets are configured to route assets through complex strategies—especially ones involving liquidity hooks and public execution helpers—attackers may not need to break contract code. They may only need to steer existing pathways into attacker-controlled counterparty logic.

At the same time, the fact that an MEV bot intercepted the extracted rsETH illustrates another dynamic: even when exploitation succeeds in pulling funds into a usable form, automated market mechanisms can reorder outcomes and reduce the attacker’s ability to complete settlement.

For readers tracking recovery and downstream impacts, the most important immediate variable will be the duration and scope of Kelp’s pause and whether the protocol can identify the remaining movement rights or any other affected addresses. Beyond that, attention will likely shift to what developers and auditors recommend for safely handling custom modules, keeper multicalls, and Uniswap v4 hook integrations in production wallet setups.

A Bank for International Settlements working paper has found that estimates of Bitcoin onchain transfer value can differ by as much as sixfold depending on how researchers treat transaction outputs.

The Bank for International Settlements working paper, titled Hidden by complexity? Measuring stablecoin, crypto and decentralised finance ecosystems, was written by Timothy Aerts, Ronald Heijmans, Jan Paulick and Violeta Vuletic and published in September 2026. The research uses data from Bitcoin, Ethereum and Tron collected through Mercurius, a project operated by De Nederlandsche Bank and developed with the BIS Innovation Hub and Deutsche Bundesbank. Read BIS Working Paper 1377

Across the three networks, the Mercurius dataset contains 100 billion records. The paper cautions that the figure represents data points stored through its processing system and should not be read as 100 billion distinct blockchain events. Ethereum and Tron records can overlap between base-layer and smart-contract data, while information can appear at several stages of the processing pipeline.

Bitcoin onchain transfer estimates depend on change handling

For its Bitcoin analysis, the study examined data covering 2009 through 2026, including approximately 1.3 billion transactions and 3.6 billion transaction outputs. Researchers tested three ways of calculating transfer value because Bitcoin’s unspent transaction output, or UTXO, model can return unused funds to the sender as change.

The paper’s upper estimate counts the value of all outputs. An adjusted measure removes outputs sent back to the sending address, which researchers treated as likely change. A conservative lower estimate removes identified self-transfers or, when none can be identified, subtracts the transaction’s largest output under the assumption that smaller outputs represent the economic transfer.

Applying the different methods produced gaps of as much as sixfold in monthly estimates of Bitcoin onchain transfer value. Figure 5 in the study shows raw, adjusted and lower-bound estimates diverging sharply during several periods, especially when Bitcoin activity and prices increased.

Researchers cautioned that their lowest estimate is a conservative heuristic, not a mathematically certain measure. CoinJoin transactions can contain several change outputs, while mixers, spam activity and intermediary transfers create other classification problems that the model does not attempt to remove. The paper found that self-transfer exclusions became more pronounced from March 2016 as address reuse increased.

The authors said commonly quoted metrics can convey “a degree of accuracy that is not supported by the nature of the underlying data.”

Bitcoin market cap changes under alternate valuation methods

The same measurement problem appears when valuing Bitcoin’s supply. The study compared conventional market capitalization with measures that account for long-dormant coins and the price at which individual outputs last moved.

Standard market capitalization applies the current Bitcoin price to all outstanding supply. One alternative in the paper removes UTXOs that have remained untouched for more than 15 years. Using that threshold excluded just over 1.8 million BTC from the calculation, although the researchers stressed that inactivity cannot prove private keys have been lost.

Their data show approximately 3.5 million BTC had remained dormant for more than 10 years, while 1.8 million BTC had not moved for more than 15 years. Yet nearly 24,000 BTC eventually moved after sitting dormant for over a decade, including close to 3,000 BTC that moved after 15 years. The researchers cited those movements as evidence that age-based lost-coin estimates remain uncertain.

A separate measure, realized capitalization, values each unspent output using the Bitcoin price recorded when that output was created after its previous spend. The BIS analysis found conventional market capitalization reached as much as four times realized capitalization during periods of rapid price appreciation. During Bitcoin’s sharp 2022 decline, realized capitalization temporarily stood above conventional market capitalization because older outputs retained their previous valuation.

In related coverage, a crypto.news explainer on Bitcoin realized price describes realized capitalization as the basis for calculating the market’s aggregate onchain cost basis. Crypto.news reported in August that Bitcoin’s realized capitalization rose by more than $4.6 billion during one seven-day period, based on CryptoQuant data. Read the related Bitcoin realized-cap report

Ethereum and USDT create different data problems

Ethereum presented a different challenge because a single transaction can call several smart contracts and generate information across transaction inputs, execution traces and event logs. The BIS researchers examined 67.5 million deployed and active Ethereum contracts and could not place more than 54 million into their technical categories.

Among contracts they could classify, close to 12 million were proxies, 1.4 million were fungible-token contracts and approximately 100,000 were NFT contracts. Researchers used bytecode and standards such as ERC-20 and ERC-721 for classification but warned that adherence to a technical standard does not establish a contract’s economic purpose.

Naming created another source of noise. The paper identified the USDT symbol across roughly 7,000 Ethereum token contracts even though only one represented Tether’s official Ethereum issuance contract. Its analysis excluded the genuine Tether contract when studying imitation or potentially spurious USDT-labelled tokens.

Cross-chain USDT data showed a separate contrast. On Ethereum, the proportion of USDT held in smart contracts climbed above 20% in 2022 and stayed mostly between 15% and 20% until late 2024 before falling into a roughly 10%–15% range. On Tron, smart-contract accounts held around 1% of USDT during most periods examined.

The researchers associated Ethereum’s smart-contract balances with activities including liquidity provision, lending and other DeFi uses. They described Tron USDT as appearing more frequently in transactional and store-of-value activity, while warning that account type remains an imperfect proxy because externally owned addresses can represent payments, exchange custody, remittances or holdings.

In related coverage, crypto.news reported that Tron processed $2.1 trillion in USDT transfers during the second quarter of 2026, citing Messari data, while its USDT supply ended the quarter at $87.9 billion. Read the crypto.news Tron USDT report

BIS favors ranges as Visa filters stablecoin activity

For future measurement work, the authors recommend supplementing single-number estimates with bounded ranges that disclose protocol-specific uncertainty. Their framework calls for technical contract classification, explicit assumptions and separate treatment of an asset’s identity and the blockchain infrastructure on which it operates. The authors described onchain indicators as “noisy approximations rather than direct measures of economic activity.”

The publication is a BIS Working Paper and does not itself introduce a regulation, compliance deadline or reporting requirement. BIS states that Working Paper views belong to their authors and do not necessarily represent the institution or its member central banks.

A comparable filtering process is already visible in the Visa Onchain Analytics dashboard, developed with Allium Labs. Visa separates total stablecoin activity from an adjusted measure designed to filter high-frequency trading, bots, bridge routing, centralized exchange activity, minting and burning, and other transfers that may not resemble ordinary settlement.

A Sept. 16 dashboard snapshot carried by TradingView from Cointelegraph showed $6.4 trillion in total stablecoin transaction volume over the preceding 30 days and $313.1 billion after Visa’s adjustments. The live Visa methodology states that its single-direction filter counts only the largest stablecoin transfer within one transaction, reducing duplicate internal movements generated by complex smart-contract calls.

Visa’s address filter includes transfers in adjusted volume when the activity meets its economic criteria and an address has not sent more than 1,000 transactions or $10 million in volume during a 30-day period. The dashboard classifies activity across payments, DeFi, centralized exchanges, investment and trading, store of value, minting and burning, short-term routing and infrastructure, while transactions below $250 that pass its adjusted filter are classified as retail-sized.

Former Commodity Futures Trading Commission Chairman J. Christopher Giancarlo has said U.S. regulators can continue building crypto rules after the Senate failed to advance the CLARITY Act in a 49-50 procedural vote.

Giancarlo told journalist Eleanor Terrett on Sept. 16 that Securities and Exchange Commission Chairman Paul Atkins and CFTC Chairman Michael Selig remain prepared to use their agencies’ existing powers to establish digital asset frameworks even without new legislation from Congress.

“@SECPaulSAtkins and @ChairmanSelig are determined to do what their jobs require them to do and put in place sound regulatory frameworks that ensure that financial innovation, market modernization and economic growth take place under U.S. law and not outside it,” Giancarlo said.

The comments came hours after senators rejected cloture on the motion to proceed to H.R. 3633, the House-passed Digital Asset Market Clarity Act. The Senate’s official roll call recorded 49 votes in favor and 50 against, leaving the motion 11 votes short of the 60 needed to advance.

Giancarlo, who chaired the CFTC from 2017 to 2019 and became known in the crypto industry as “CryptoDad,” is scheduled to join former CFTC Chairman Timothy Massad and former SEC Commissioners Troy Paredes and Caroline Crenshaw for a panel hosted by Terrett at the Avalanche Summit in New York later Wednesday.

CLARITY Act failure turns attention to SEC and CFTC

The Senate vote has put more attention on the SEC and CFTC after months of work by both agencies on digital asset rules that do not depend on passage of the CLARITY Act.

The bill would have created a statutory division of responsibilities between the SEC and CFTC for digital assets, while establishing registration routes for exchanges, brokers and dealers. It contained provisions covering ethics restrictions for senior government officials and Treasury authority related to payment stablecoins.

Republicans had revised the legislation during negotiations with Democrats before the Sept. 15 vote. The dispute was not limited to how many Democratic proposals were incorporated into the text. Democratic lawmakers maintained that the ethics provisions remained insufficient, particularly in addressing crypto interests connected to President Donald Trump and his family. Associated Press reported that Democrats sought stronger restrictions even after concessions were made on enforcement powers and restrictions covering federal officials.

The ethics issue had remained one of the main unresolved parts of the negotiations in the days before the vote. As crypto.news previously reported, an earlier revised draft restricted public officials, government employees and their spouses from issuing or sponsoring digital assets, while leaving primary enforcement authority with the Justice Department and setting the provision to expire in January 2029.

All Democrats who participated in Tuesday’s vote opposed cloture. Republicans Susan Collins of Maine, Josh Hawley of Missouri, Jerry Moran of Kansas and Thom Tillis of North Carolina voted against the motion as well. Tillis changed his vote for procedural reasons, preserving the ability to seek reconsideration. Reuters reported that the last-minute revisions were not enough to overcome disagreements over ethics and banking provisions.

Sen. Chris Coons of Delaware did not vote. Democratic negotiators including Sens. Kirsten Gillibrand, Mark Warner, Cory Booker, Raphael Warnock, Ruben Gallego, Angela Alsobrooks and Catherine Cortez Masto were among those who voted against advancing the measure.

Industry executives turn to regulators for crypto rules

Coinbase CEO Brian Armstrong said after the vote that the industry “can’t wait on Congress anymore,” arguing that the SEC and CFTC can use existing authority to establish digital asset rules.

His comments followed a position he had taken before the vote. Armstrong had said the industry could receive regulatory clarity regardless of the Senate result because federal agencies were preparing to act if Congress did not. His pre-vote position was reported on Sept. 10, when negotiations over the legislation were still underway.

Ripple CEO Brad Garlinghouse described the result as “this one stings” and called on Atkins and Selig to “fill the legislative gap.”

Senate Banking Committee Chairman Tim Scott, one of the lawmakers behind the bill, took a similar position after midnight Wednesday, saying the SEC and CFTC should “set clear rules of the road for digital assets until Congress legislates.”

Sen. Cynthia Lummis of Wyoming blamed Senate Democrats for the result and argued they were not serious about passing market structure legislation. Democrats disputed the Republican account of the negotiations and maintained that unresolved ethics concerns, including restrictions involving public officials’ crypto interests, required stronger language before they would support the measure.

House Financial Services Committee Chairman French Hill and House Agriculture Committee Chairman Glenn Thompson said after the vote that only Congress could provide lasting statutory certainty, while supporting regulators’ use of existing authority until lawmakers reach an agreement.

Regulators have prepared rules outside the CLARITY Act

Giancarlo has argued for months that agency rulemaking could continue if Congress failed to enact market structure legislation. He retired from law practice at Willkie Farr & Gallagher in April to focus on digital assets, artificial intelligence and public policy.

The SEC has already moved forward with its own crypto framework. On Aug. 18, the agency proposed Regulation Crypto Assets, a 402-page framework containing two registration exemptions and a conditional safe harbor for certain crypto asset investment contracts.

The proposal would allow qualifying issuers to raise up to $5 million over four years under one exemption and as much as $75 million during a rolling 12-month period under another. The  Regulation Crypto Assets proposal contains disclosure requirements alongside a pathway under which qualifying tokens could leave investment contract treatment once specified conditions are met.

Atkins had been developing the framework while lawmakers negotiated the CLARITY Act. Before the Senate vote, he said the agency was prepared to continue its crypto work regardless of whether Congress completed market structure legislation. The SEC’s rulemaking does not settle every issue addressed by the bill, including the statutory allocation of jurisdiction between the SEC and CFTC.

Selig has taken a similar approach at the CFTC. The agency has prepared digital asset market structure proposals that could proceed under its existing powers, with the CFTC chairman saying in August that its work would continue regardless of what happened to the legislation. The agency’s planned crypto rules were being developed before the Senate’s September vote.

CLARITY Act can still return to the Senate floor

The failed cloture vote does not remove H.R. 3633 from the Senate calendar. Whether leadership will try again before lawmakers leave Washington ahead of the November elections remains unclear.

Sen. John Kennedy of Louisiana told Terrett after the vote that he “wasn’t surprised” by the result and said the legislation could return during a lame-duck session after the elections. Sen. Ted Cruz of Texas described the measure as “mostly dead.”

Time had already become an issue before Tuesday’s vote. House Republican leaders removed eight voting days from the September calendar, leaving the chamber scheduled to depart Washington on Sept. 17. Any Senate changes to the House-passed legislation would require further House action before a final bill could be sent to the president, as detailed in earlier coverage of the shortened House calendar.

Tillis’s procedural no vote leaves the Senate with an avenue to reconsider the cloture motion. The House-passed version of H.R. 3633 remains on the Senate calendar following Tuesday’s 49-50 vote.

Crypto traders holding long, or bullish, futures bets have taken a sharp hit over the past 24 hours after the Clarity Act failed a Senate procedural vote.

Exchanges liquidated about $571 million in long positions in that window, the highest tally since Aug. 22, according to CoinGlass. Shorts, or bearish bets, accounted for only about $100 million of the wipeout.

Bitcoin and ether longs absorbed the heaviest damage, with roughly $190 million liquidated in each. Analysts had flagged ether and DeFi tokens as the assets most likely to outperform bitcoin if the Senate voted yes. XRP longs lost about $30 million, while Solana longs lost about $22 million.

The data shows markets were positioned for continued upside, largely on hopes the Clarity Act would advance. Those hopes strengthened earlier this week after reports that President Donald Trump was willing to make concessions on the bill’s ethics provisions. The market responded: bitcoin, the largest cryptocurrency by market value, rose to nearly $80,000 from about $77,000 on Monday.