Swell Pauses swETH and rswETH After Suspected Hot-Key Compromise

Swell has paused deposits and withdrawals for its two ether-backed tokens, swETH and rswETH, while it works to reverse exchange-rate increases that a security researcher says were pushed through without any ETH behind them. The protocol announced the pause on X at 07:39 BST on 23 October, saying it was working “with our security partners and Seal911 to fully secure our infrastructure”.

The incident centres on Swell’s operational “hot” keys, the always-online keys its automated systems use, rather than on the funds themselves. Swell says no ETH has left its deposit or withdrawal contracts, and the researcher’s own analysis says reaching the largest pot of ETH would need an upgrade through a seven-day timelock that had not been started. The root cause has not been confirmed.

On-chain records show the clampdown came in two steps. A multisig wallet with pause rights froze the oracle bot’s functions at 05:35 BST on 22 October, then paused core functions and withdrawals on both tokens at 07:04 BST on 23 October.

A researcher flagged unbacked rate rises in the early hours of 22 October

The first public warning came from the researcher Spreek, who posted at 02:28 BST on 22 October that “Admin keys for Swell DAO’s swETH and rswETH appear to be compromised”. The post said the actor was “raising NAV by max 1% (unbacked) each hour” and that four malicious upgrade contracts had been deployed but were “not queued yet through multisig”.

A longer incident report on GitHub sets out the timeline. It says an unknown actor had controlled Swell’s operational hot keys “since 14:25 UTC on 21 Oct”, or 15:25 BST, “including the swETH/rswETH oracle bot”. From 00:02 BST on 22 October, the report says, the actor raised both tokens’ exchange rates “by 1% an hour, the on-chain maximum, with no ETH behind the increase”.

By the time the report was written, it said swETH stood “3.0% above its last clean rate (1.133254 ETH)” and rswETH “2.0% above (1.082464 ETH)”. It also said the actor had redirected rswETH’s EigenLayer rewards claims to its own wallet, with “Nothing claimed yet”, and had moved $392,891 inside one Swell vault into a sub-account where it was “Still in place”.

Spreek said in a reply that the report had been written with an AI model: “I have not verified everything so take with a grain of salt, but I believe the top line information is correct.” The report itself says “That this is a key compromise rather than an insider is our inference.”

The 2,513 ETH figure is an exposure estimate, not a loss

The report puts the largest exposure at “about 2,513 ETH (about $6.2M at $2,476)” in four Swell withdrawal and deposit contracts. Reaching that ETH, it says, “needs an upgrade through Swell’s 7-day Timelock, run by its 4/7 Safe”, meaning four of seven signers must approve. “As of 01:20 UTC on 22 Oct, no upgrade is queued and no third-party venue has been drained,” it says.

The Timelock contract shows no new queued or executed transactions since 23 September, according to its on-chain event log as checked on the morning of 23 October.

Swell’s first statement, at 04:03 BST on 22 October, said: “No ETH has left the swETH or rswETH withdrawal or deposit contracts. No action is required.” Its update a day later said “All funds are safe” and set out the condition for reopening: “The next step to resume normal operations is to return NAV to the correct value, after which we will resume deposits and withdrawals.”

The fix is not straightforward. According to the report, marking the rate back down makes the oracle trigger an automatic “lockdown” that “pauses everything, withdrawals included”.

The Defiant reported that “onchain controls now block withdrawal requests and ETH claims” while Swell works to “correct inflated token accounting rates”.

The Railway connection rests on timing alone

Spreek’s original post asked whether the incident was “railway related?”, a reference to the cloud platform that disclosed this week that an attacker may have decrypted some customer environment variables. Asked about the link, Spreek replied: “Just timing, it’s pure conjecture on my part.” Swell’s posts have not said how its keys were exposed.

Hard limits slowed the damage, but the pause was manual

Swell’s rate oracle allowed at most a 1% change an hour, and every markup in the report used that full allowance. That cap spread the markup across hourly steps recorded on-chain, and the researcher’s warning came about two and a half hours after the first one.

The seven-day timelock is the control that separates the 2,513 ETH exposure from an actual loss. Whoever holds the hot keys can deploy contracts, but still needs four of seven multisig signers to queue an upgrade, and then a week’s wait in public view. On the Timelock’s event log, that barrier has held so far.

The pause itself was slower. Bot functions were frozen roughly three hours after Spreek’s post, and deposits and withdrawals only a day later. The report’s account of the oracle shows why a quick reversal was never on offer: correcting the rate trips the same lockdown that halts withdrawals. Swell has frozen first and left the repair for second.

Exchanges and bridges now face the compliance test

The report says “No exchange, mixer or bridge appears in the inbound funding” of the actor’s wallets, but that one wallet deposited 1,730 USDC on Lighter, moved USDC through the Across bridge and funded Hyperliquid accounts. It asks those venues to “Flag the hub wallet”. For screening teams, that turns a researcher’s on-chain trace into a list of addresses to review, before any larger sums move.

Weak points around the code, rather than in it, feature heavily in recent tallies: Hacken linked 77% of Q3 crypto-hack losses to suppliers, developer tools and unpatched fixes, and the Polkadot Community Foundation said this week that a Fearless Wallet browser extension leaked users’ private keys. TSN tracks these cases on its Crypto Hacks hub.

Swell has not given a date for reopening. The open question is whether it can restore the correct rate and rotate every exposed key without any of the four upgrade payloads reaching the timelock queue.

Sources

• Swell on X: pause announcement, 23 Oct 2026
• Swell on X: first statement, 22 Oct 2026
• Etherscan: bot-methods pause transaction, 22 Oct 2026
• Etherscan: core-methods and withdrawals pause transaction, 23 Oct 2026
• Etherscan: Swell Timelock contract
• Spreek on X, 22 Oct 2026
• Spreek: Swell hot-key compromise incident report (GitHub)
• The Defiant: Swell Pauses swETH and rswETH Deposits and Withdrawals

Related stories

• Railway Says Attacker May Have Decrypted Some Customer Environment Variables
• Hacken Says Crypto Hacks Cost $1.18 Billion in Q3 2026, Mostly Through Suppliers, Developer Tools and Unpatched Fixes