The tweet was deleted by the author.
But we saved everything 🙂.
Gnosis Safe owner loses $7.8 million in crypto over smart contract flaw
A crypto wallet owner lost around 2,900 rsETH worth $7.8 million due to a flaw in the authorization mechanism of a helper smart contract. Security researchers found that the issue did not affect Safe's core contracts but originated in a third-party component that the user had authorized to access the assets.
The attack occurred on Ethereum and affected a Gnosis Safe wallet. To automate transactions, the owner had allowed a helper contract to move funds on their behalf—an arrangement commonly used for purposes such as automated trading.
View post on X Loading...
However, the contract's access control check was implemented incorrectly. According to SlowMist and BlockSec, the system effectively allowed any user to execute a transaction if they specified the helper contract itself as the target.
Bot intercepts 2,900 rsETH
Using the flaw, the attacker initiated a swap of around 2,900 rsETH through a trading pool created just minutes earlier with a virtually worthless token called Permissionless Attacker Token. As a result, the wallet was set to give up liquid assets in exchange for tokens with no real value.
However, the original attacker did not manage to complete the operation. An automated bot known as yoink detected the transaction and front-ran it, paying around $47,000 for priority.
As a result, the bot obtained the assets and transferred 2,882 rsETH to a separate address. Analysts confirmed that the funds were intercepted by front-running the original attack transaction.
AstraSec identified a flawed authorization check in the Multicall contract as the root cause of the incident. Other security researchers also concluded that the vulnerability was not in Safe's core contracts but in a component that the wallet owner had independently granted trusted permissions.
Kelp DAO temporarily freezes suspicious address
Kelp DAO, the issuer of rsETH, said its own contracts remained secure and the token was fully collateralized. After detecting suspicious activity, the project temporarily restricted transactions involving the address that received the stolen assets.
The restriction was imposed for 24 hours. During that period, rsETH could not be transferred to or from the suspicious address while the team investigated the incident.
A similar infrastructure incident occurred earlier on Liquid Network. Hackers withdrew around 4,000 BTC worth approximately $320 million from the wallet holding the Bitcoin backing LBTC, prompting the network to suspend operations.
At the time of the attack, the amount represented around 95% of Liquid Network's Bitcoin reserves, which stood at approximately 4,200 BTC before the incident. Some of the funds were later returned after the vulnerability was fixed.
Earlier, we reported that the Cronos blockchain was completely halted following an attack on Tectonic, the largest lending protocol in its ecosystem. Preliminary losses from the exploit were estimated at around $75 million.
This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.
Subscribe to TU news
Did you like the article?
Latest Scam Alert News
Top News
Top 5 companies for you
United States
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
Live News
