An unidentified actor reportedly gained control of Swell DAO’s operational hot keys, including the oracle bot that sets exchange rates for its liquid staking tokens swETH and rswETH, according to a report by security researcher Spreek on October 22, 2026. The actor allegedly used that access to raise the tokens’ exchange rates without new ETH backing, leaving the rates inflated on paper.
What researchers say happened
According to Spreek’s report, the actor had control of the keys as of 14:25 UTC on October 21. From there, the actor allegedly began raising the exchange rates of both tokens at the maximum pace the system allows: 1% per hour. No new ETH came in to back those higher rates.
By October 22, swETH’s rate had reportedly climbed about 3.0% above 1.133254 ETH. The rswETH rate sat roughly 2.0% above 1.082464 ETH.
Spreek’s report also says four malicious upgrade contracts were deployed. If those upgrades were executed through Swell’s timelock, they could sweep approximately 2,513 ETH from various contracts. The upgrades are loaded but have not fired.
Swell’s response and the open questions
The Swell team confirmed it is investigating the suspicious activity. It said no ETH had been withdrawn from or deposited into the affected contracts, and that the protocol remains fully operational.
There is a reported but unconfirmed potential link to the Railway cloud platform, which researchers flagged following a disclosure from that platform. AI tools also partially assisted in documenting the breach, according to the research findings, meaning certain details in the public account have not been independently confirmed.
Why an oracle bot matters
An oracle bot is the piece of automation that reports the token exchange rate on-chain. Whoever controls it effectively controls what the protocol says one token is worth. Hot keys are the private keys kept online so bots can sign routine transactions.
The 1% hourly cap limited how fast the damage could compound, but did not stop the rate from rising.
Markets are not buying the new rates
Decentralized exchange prices have reflected only a fraction of the reported inflation, suggesting possible market dislocations between the on-chain rate and where the tokens actually trade.
Swell’s total value locked stood at approximately $29.41 million on the day of the report. The market cap for rswETH ranged between $27 million and $58 million, depending on the data source. Third-party venues remain unaffected, and no draining of outside platforms has occurred.
What this means for holders and DeFi
For swETH and rswETH holders, the immediate question is the timelock. If Swell’s governance can block or cancel the four queued upgrades before they execute, the approximately 2,513 ETH may never be touched.
Any venue that values these tokens using the on-chain exchange rate, rather than market prices, could theoretically be exposed to collateral that looks healthier than it is. The research notes that outside platforms have not been drained.
If the Railway connection is confirmed, it would point to infrastructure outside the smart contracts themselves as the weak link — a reminder that a protocol’s security extends to every service its bots run on.
