Gnosis Safe Exploit Drains $7.8M in rsETH Through Flawed Helper Contract

A Gnosis Safe wallet on Ethereum lost about 2,900 rsETH, worth roughly $7.8 million, after an attacker abused a faulty authorization mechanism in a helper contract, according to Bitquery’s on-chain investigation. The reconstruction points to a module or helper path trusted by the wallet rather than a failure in Safe’s core contracts.

The incident appears to have centered on an authorized contract path that accepted caller-supplied input without properly gating who could use it. In the account traced by Bitquery, that design let an external actor reach a module entrypoint and direct the Safe to execute actions in its own context, which is what made the drain possible.

Security coverage tied the loss to a Sept. 15 incident and said the funds were removed through the flawed helper route. The investigation also noted in-block MEV capture during the event, indicating that transaction ordering played a role in how the stolen assets were taken.

A module-level failure, not a core Safe breach

The key distinction in the reporting is that the loss is described as module-authorization abuse specific to one Safe setup. That means the issue was tied to the wallet’s trusted helper or strategy component, not to a direct compromise of Safe’s core protocol or owner keys.

That separation matters for readers following smart contract wallet risk. A Safe can remain secure at the protocol level while still exposing funds through third-party extensions, custom modules or other trusted components with weak checks. In this case, the vulnerable path was enough to move the rsETH out of the wallet.

The reporting does not indicate that all Safe users were affected. It also does not support reading the event as a broader failure of Safe’s core contracts. The confirmed loss is tied to the specific wallet and helper logic involved in the exploit.