Check Your Safe Wallet Modules: How One Module Moved $7.7 Million Without a Signature

On September 15, 2026 an Ethereum wallet lost around 2,882 rsETH without a single owner signature being required. The wallet was a Safe multisig, the very design that counts as particularly secure because several keys have to sign together. The balance drained anyway, through a module the owners had enabled themselves. If you use a smart contract wallet, the task after this case is small and concrete: look at which modules are enabled in your wallet, and remove anything you no longer need or can no longer explain. This article explains what a module is technically allowed to do, how the September 15 attack unfolded, and how to run the check yourself in a few minutes. Going through the interface costs you no fee. Only removing a module is a transaction, and that needs the regular number of signatures. Safe module explained: what a module may do in a smart contract wallet A Safe module is a smart contract of its own that the wallet permanently allows to execute transactions on its behalf, without the usual number of owner signatures coming together. That is not a flaw in the design, it is the point of the design. Anyone who wants to run automatic payroll, a recurring rebalancing routine or a liquidity strategy cannot have three people sign off on every step. So the wallet delegates that part to a contract. Technically this runs through the function execTransactionFromModule, or its variant with a return value. An enabled module calls it, and the wallet executes whatever the module instructs. The signature threshold is not circumvented in the process; it is simply not provided for on this path. The Safe documentation spells out the consequence with unusual clarity: modules can execute arbitrary transactions, only audited and trusted modules should be added, and a malicious module can take over a wallet entirely. It is set out in the official Safe documentation on smart account modules. Two properties make modules attractive to attackers. First, they are permanent: once activated, a module stays active until somebody explicitly switches it off. Second, they are invisible day to day. You do not see them when sending, not when receiving and not in the balance. They show up only where you go looking for them. The September 15 attack: how DELEGATECALL released 2,882 rsETH The outflow landed in block 25980525 at 04:38:47 UTC. It hit a single Safe wallet holding a leveraged position in rsETH, the liquid restaking token from Kelp DAO. The security firms Blockaid and PeckShield reported the incident first; their damage figures differ slightly and sit between 7.73 and 7.81 million dollars. The quantity is more precise than the dollar figure: 2,882.37 rsETH.