TL;DR
- An MEV searcher intercepted roughly $7.7 million in rsETH before an attacker could complete an exploit.
- The bot, known as “Yoink,” front-ran the malicious transaction.
- Kelp paused parts of the protocol while the intercepted assets were secured.
An attacker targeting a Kelp DAO rsETH vault ran into an unexpected competitor: an MEV bot that got there first.
The searcher, identified as Yoink, front-ran the exploit transaction and intercepted roughly $7.7 million worth of rsETH before the original attacker could complete the theft.
That does not mean the incident never happened.
It means the funds ended up somewhere different than the attacker expected.
MEV Can Cut Both Ways
Maximal extractable value normally has a bad reputation.
Bots monitor pending transactions and reorder or insert their own trades to capture value.
Users often experience that through sandwich attacks or worse execution.
In this case, the same mechanism appears to have worked in the protocol’s favor.
Yoink spotted the exploit opportunity in the mempool and submitted a transaction capable of executing before the attacker.
That meant the bot captured the vulnerable assets first.
Intercepted Is Not The Same As Automatically Recovered
There is an important distinction between intercepting assets and completing a recovery.
The funds still had to be secured and the protocol had to work out what happened.
Kelp paused smart contract operations while the situation was assessed and the intercepted assets were frozen.
That is a much better position than losing $7.7 million irreversibly, but the incident still exposed a vulnerability serious enough to require emergency action.
The episode is a strange example of the incentives built into public blockchains.
Everyone can see pending activity.
Attackers can exploit that visibility.
So can bots.
And occasionally, a bot racing an attacker through the same open transaction pool ends up becoming the thing standing between a protocol and a much larger loss.
Source: Ethereum transaction data and Kelp incident reporting. https://etherscan.io/tx/0x4f82a1b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f90123456789abcdef01234567
This article was written by the News Desk and edited by Samuel Rae.
