Coding flaw in helper contract leads to $7.8 million crypto wallet hack

An attacker exploited a coding flaw in a helper contract to drain approximately $7.8 million from a Gnosis Safe wallet on Ethereum, before a trading bot front-ran the transaction to seize the funds.

The heist occurred early Tuesday, with the attacker moving about 2,900 rsETH from the victim’s wallet. Security firms SlowMist and BlockSec traced the vulnerability to a helper contract that the wallet owner had authorized to move funds on their behalf, a common setup for automated trading.

Investigators found the helper contract contained a critical flaw: it would approve any caller that named the contract itself as its target, bypassing intended permission checks. This allowed the attacker to gain unauthorized access.

In a twist, an automated trading bot named “yoink” detected the malicious transaction in the public mempool. The bot paid approximately $47,000 in gas fees to have its own transaction processed first, effectively hijacking the stolen tokens from the original attacker.