An MEV bot operating under the name "Yoink" intercepted a haul of rsETH worth $7.8 million before a hacker could complete the theft, according to on-chain records cited in a report by shattered.io. The bot beat the attacker's transaction to the funds, an outcome that turns an attempted exploit into a race settled in mempool priority rather than by the attacker's intent.

RsETH is a liquid restaking token minted on Ethereum, representing restaked positions and designed to remain transferable while the underlying stake secures additional protocol layers. Tokens of this type carry elevated risk during exploits because the value sits in contracts that bridge staking, restaking and DeFi composability in one instrument.

What did the bot actually do?

MEV — maximal extractable value — describes the profit an actor can capture by reordering, inserting or censoring transactions inside a block. Bots such as Yoink monitor pending transactions and simulate outcomes. When a bot spots an exploitable state change, it can submit its own transaction with a higher fee or better positioning, effectively front-running the attacker within the same block.

In this case, the bot reached the $7.8 million in rsETH first. The practical consequence: the funds moved to an address controlled by an automated strategy, not to the person who engineered the exploit path. The outcome inverts the usual post-hack dynamic, in which teams race to freeze contracts or negotiate a bounty after the assets have already left.

Who holds the $7.8 million now?

The bot's operator, not the protocol and not the attacker, controls the seized rsETH at time of publication. Precedent from prior incidents suggests a negotiated return is possible, typically in exchange for a bounty, though no such arrangement has been confirmed in this case.

For the protocol behind rsETH, the operational picture is more favorable than a completed theft. The exploitable path has been demonstrated on-chain, which means the team faces pressure to patch the vulnerability before a second attempt succeeds where the first was outrun.

Why does this matter for market structure?

The incident illustrates a shift in how value leaks are contested. Defense no longer depends solely on auditors or emergency pauses; it can occur inside block construction itself, where bots compete in milliseconds.

That dynamic cuts both ways. The same capability that recovered $7.8 million here serves extractive strategies against ordinary users in other contexts, a tension regulators and protocol designers continue to weigh as Ethereum's transaction supply chain grows more competitive.

Expect follow-up reporting to confirm whether the bot's operator returns the rsETH and whether the protocol identifies and fixes the exploited path. The window between a demonstrated exploit and a patched contract is when a second attacker has the strongest incentive to move.

By Tom Whitfield