Swell, an Ethereum staking protocol, halted deposits and withdrawals for swETH and rswETH at 2:39 a.m. ET on Friday, October 23, after the contracts began reporting abnormally high exchange rates.
The swETH contract displayed a rate of approximately 1.203 ETH, roughly 6% above its last recorded normal rate of 1.133 ETH. The rswETH contract showed a similar spike to around 1.138 ETH, approximately 5% above its last clean rate of 1.082 ETH.
Market Impact and Token Holdings
On decentralized exchanges, the tokens traded below their reported contract rates. Uniswap showed swETH trading near 1.089 WETH in a pool with approximately $143,000 in liquidity, while rswETH traded near 1.029 WETH on Curve. According to DefiLlama, swETH holds about $29 million in total value, with rswETH holding roughly the same amount.
Swell stated that no ETH has left the affected contracts but did not confirm the cause of the rate inflation or provide a reopening date. The team said its next step is returning the net asset value (NAV) of both tokens to the correct level.
Security Concerns and Investigation
On-chain analyst Spreek identified possible compromised admin keys for both tokens and discovered four malicious upgrade contracts capable of accessing approximately 2,500 ETH. None of these contracts had been queued through Swell's multisig.
Odysseus, founder of Phylax Systems, described the incident as potential "BOT-key abuse," noting that the 2,513 ETH in question represents an unconfirmed loss.
Researchers identified a possible link to Railway, a cloud deployment platform, which disclosed on October 21 that an unauthorized third party may have accessed some encrypted environment variables. However, Railway's disclosure did not mention Swell, and Swell has not confirmed any connection to the incident.
Swell stated it was working with security partners and warned that such events could trigger additional phishing attempts.
