Swell Network (SWELL, swETH, rswETH): liquid staking, restaking and the October 2026 pause

Update, 1 November 2026, 19:20 UTC: Swell has reset both exchange rates and reopened withdrawals of swETH and rswETH, but direct ETH deposits still fail on the contracts, even though Swell’s account said deposits are open. According to The Defiant, Swell’s post-mortem blames a compromised operational key and promises to compensate 20 addresses, short by about 0.25 ETH in all, within a week. We could not read Swell’s own posts, so those points come from The Defiant’s report, in the copy KuCoin republished; the rates and pause flags are our own reads.

Swell Network, the Ethereum protocol behind the swETH and rswETH staking tokens, froze both from 06:39 UTC on 23 October 2026 after, by Swell’s account and that of outside researchers, their exchange rates had been pushed up with no ETH behind them. At 10:46 UTC on 1 November a multisig set the rates back to about 1.1334 ETH per swETH and 1.0828 ETH per rswETH and lifted the withdrawal pause. Direct deposits were still blocked on both contracts at 19:17 UTC that day.

The freeze hit a project that was already much smaller than it used to be. In March 2024 swETH alone held close to $978 million, according to DefiLlama. On the evening of 1 November 2026 swETH held about $25.5 million and rswETH about $26.1 million. Swell shut its own layer 2, Swellchain, at the end of June 2026, and its homepage now says “Swell is evolving into Faro”, a trading app for Hyperliquid.

Swell now gives a cause, as reported by The Defiant: a compromised operational key used to file false balance reports on 21 and 22 October. It says no ETH backing the tokens moved, and it puts the shortfall at about 0.25 ETH across 20 addresses that deposited at the inflated rate.

Swell Network: liquid staking and restaking on Ethereum

DefiLlama lists Swell as a non-custodial liquid staking protocol. A holder deposits ETH and receives a token that can be moved, traded or used in other apps while the ETH underneath earns validator rewards. Swell issues two of them, swETH for plain staking and rswETH for restaking. Its token post gives the Swell DAO a say over liquidity incentives, pool parameters, grants and the choice of node operators.

The team started in 2021 or 2022, depending on the source, and is based in Sydney according to secondary profiles. Its GitHub organisation was opened on 21 January 2022 and held 23 public repositories when we checked on 24 October 2026. The website names no leadership. A third token, SWELL, carries governance votes and, since March 2026, is the currency of Swell’s fee auctions.

Swell later added a BTC restaking token, an earn vault and a farm on Swellchain. DefiLlama showed each of them under $2 million on 24 October 2026, which is why this page deals with the two ETH tokens.

How swETH works: one token, a rising exchange rate

swETH went live on Ethereum mainnet on 25 April 2023, in a public beta Swell called Seawolf. The launch post presented a reward-bearing ERC-20 that could be kept in MetaMask, Ledger or Trezor, with zero fees “for a limited time only”. It does not rebase. The number of swETH in a wallet stays the same; what changes is how much ETH each one is worth.

Behind the token, a list of node operators queue validators, and each validator is deployed once 32 ETH is available for it. That is how Sigma Prime, which audited the contracts in 2023, sums up the design. According to Swell’s documentation as summarised by the exchange Gate, operators could join without permission by posting 16 ETH of collateral per validator, or through a whitelist with 1 ETH per validator, and set a commission of up to 10%. We could not open Swell’s docs to confirm those terms.

The exchange rate is not set by the market. A trusted bot account, the BOT role in the code, calls a repricing function that tells the contract how much ETH stands behind the token supply. The Barracuda upgrade of February 2024, which brought withdrawals, kept that model: holders unstake swETH into ETH “at the primary repricing rate”, as Sigma Prime’s review of the upgrade puts it, and a repricing oracle contract receives the bot’s snapshots.

Leaving through the protocol takes two steps, a withdrawal request and a later claim. The code quoted in Cyfrin’s February 2024 report pays the lower of two rates: the one recorded when the request was made and the one supplied when the bot processes it. A drop in the rate while a request waits therefore lands on the holder. We found no public date for when swETH withdrawals went live.

rswETH: restaking through EigenLayer

rswETH was announced on 29 January 2024. ETH sent to it goes into a separate restaking pool whose validators point to EigenLayer‘s contracts, so the same stake can also secure other services. Swell called this native restaking. The token holds staked ETH, not swETH, and restaking swETH on EigenLayer does not give you rswETH.

Like swETH, rswETH gains value against ETH through its exchange rate. At launch Swell set no limit on deposits and said it would pass all EigenLayer points to holders. Withdrawals were promised “in the coming weeks”; secondary reports from July 2024 said they had been audited by Nethermind and Sigma Prime. Holders of both tokens also earned Pearls, Swell’s points, which counted towards the SWELL airdrop.

Fees and the Fee Flow burn

The rswETH launch post set the fee at zero for the first 30 days and 10% after that. Gate describes the 10% as a cut of staking rewards on both tokens, shared equally between node operators and the treasury. Swell’s own post does not give the split.

On 6 March 2026 Swell gave those fees a second job. Under Fee Flow they build up in swETH and rswETH and are sold every 14 days in a Dutch auction, where the price starts high and falls until someone buys, paying in SWELL. That SWELL is sent to a burn address. Swell says the model is adapted from Euler’s fee flow. It has not published how much SWELL has been burned.

Swellchain shutdown: an L2 launched in December 2024, closed in June 2026

On 13 March 2024 Swell said it would build its own layer 2, a “restaked rollup” on Polygon’s CDK with AltLayer, with rswETH as gas and a governance token to follow. Founder Daniel Dizon told The Block it was “the next logical step for the Swell community and DAO”. Swell’s products held more than $1.1 billion at the time, the same report said.

The plan changed on 30 October 2024. Swell moved the chain to the OP Stack, joined Optimism’s Superchain, chose ETH rather than rswETH as gas and agreed to share part of its sequencer revenue with the Optimism Collective, The Block reported, putting Swell’s deposits above $1.3 billion. Swellchain launched in full on 19 December 2024. L2BEAT, which rates rollups, records it as deployed through AltLayer with permissioned fraud proofs and says it “is not even a Stage 0 project”.

It ran for about 18 months. On 28 April 2026 Swell announced it would sunset Swellchain and put its engineers on Faro. The post says restaking matured more slowly than expected and several large projects changed their roadmaps. Ethereum’s main chain had also scaled and kept fees low, which made some L2s less needed, and keeping the chain alive would have pulled people away from Faro.

Users got about seven weeks. Bridging from Ethereum to Swellchain stopped on 5 May, and 15 June was the last day to start a withdrawal through the app; after that, Swell warned, “recovery may not be possible.” The chain kept producing blocks until 30 June 2026, with exits still possible by calling the contracts directly and a seven-day proof window. swETH and rswETH, Swell said, would carry on as normal on Ethereum mainnet.

One record does not match. L2BEAT now shows Swellchain as archived and logs a pause triggered by the chain’s pause deputy on 5 August 2026, with a scheduled expiry on 4 November, and a sunset notice added on 10 August. Swell has not explained those dates. About $329,000 was still counted in the Swellchain bridge on 24 October by both L2BEAT and DefiLlama.

Faro, the Hyperliquid app Swell is turning into

Faro calls itself an AI-powered trading platform for Hyperliquid, the perpetual futures exchange with its own chain. It mixes on-chain data, sentiment and social signals and lets users trade from the same screen. On 24 October 2026 its site showed a private beta with a waitlist, said Faro never holds users’ funds or keys and priced the Pro plan at $249 a month. ICEC Ventures, Framework Ventures, Maven 11 Capital and The Spartan Group are listed as backers. No team member is named.

The sunset post said SWELL stays an ERC-20 on Ethereum and that Swell was designing a status program to tie the token to Faro, with details “in the coming weeks”. Six months later Faro’s site still only says SWELL will get in-app use. We found no published version of the program as of 24 October.

TVL fell 97% from its March 2024 peak

Swell’s growth rode the restaking points season of 2024. According to DefiLlama, swETH reached $977.7 million of total value locked on 12 March 2024, the day before the L2 announcement, and rswETH peaked at $500.4 million on 28 May 2024. Both fell through the second half of 2024 and were under $100 million by March 2025. A bounce in mid-2025 took swETH back to $127 million at the end of July. By February 2026 both were under $40 million.

The last line is about 2.6% of the swETH peak and 5.2% of the rswETH one. Two cautions apply. The peaks fell on different days, so they cannot be added into a single record. And the 24 October line was computed while the tokens carried a rate since cut by about 6% and 5%. The 1 November line follows the reset: the contracts then showed about 9,939 swETH and 10,644 rswETH in supply at 19:17 UTC, or roughly 11,265 ETH and 11,525 ETH at the new rates.

SWELL token supply and unlocks

SWELL launched on 7 November 2024. Claims for the Voyage airdrop opened at 09:00 UTC and exchange listings followed at 10:00 UTC. Swell’s token post sets a maximum supply of 10 billion SWELL, with about 13% circulating at launch. CoinGecko’s page showed 5.222 billion in circulation on 1 November 2026.

• The community gets 35%: 8.5% for the Voyage airdrop to Pearl holders, 7.5% for six later Wavedrops, about 1.67% for a liquidity campaign and about 17.33% for the ecosystem.
• The team holds 25%, released in a straight line over 36 months from launch after a 12-month cliff.
• Investors hold another 25%, locked for 12 months and released over 30 months from launch.
• The foundation holds 15%, of which 5% was free at launch and 10% vests over 36 months.

Both lock-ups ended on 7 November 2025. Swell’s wording says both schedules start “from TGE”, which would put the end of the monthly token unlocks in May 2027 for investors and November 2027 for the team. Some trackers start the clock after the lock-up instead and run them into 2028, so check a live unlock tracker before relying on a date. SWELL votes in governance, can be staked as rSWELL with a three-day cooldown to unstake, and since March 2026 is what bidders pay in the Fee Flow auctions.

Investors hold a quarter of the supply, far more than a $3.75 million seed round alone would suggest. Swell has not published the price its backers paid, and no later round is public.

Swell team and funding

Daniel Dizon is named co-founder and chief executive in the March 2022 seed announcement. His Forkast profile places him in Sydney and mentions advisory work on blockchain for the New South Wales government. Lecky Lao was introduced as co-founder and chief technology officer in CoinDesk’s report on the same round. We found no 2026 source confirming either man’s current role, or saying who runs Faro.

The $3.75 million seed round was announced on 14 March 2022. CoinDesk reported it was co-led by Framework Ventures, IOSG Ventures and Apollo Capital. The press release added Maven 11 and angels including Mark Cuban, Synthetix founders Kain Warwick and Jordan Momtazi, Balancer’s Fernando Martinelli, and Bankless hosts Ryan Sean Adams and David Hoffman. Framework and Maven 11 now also appear among Faro’s backers.

Swell audits: what Sigma Prime and Cyfrin flagged about the bot

Swell’s contracts have been reviewed several times. Runtime Verification looked at an early, NFT-based version in July 2022, in a three-week review that left parts of the code out of scope. Sigma Prime audited swETH before launch and found 16 issues (three medium, five low, eight informational), which Swell said on 13 April 2023 were all resolved. Sigma Prime and Cyfrin both reviewed the Barracuda withdrawal upgrade in February 2024. Swell’s public GitHub folder also holds reports on rswETH by Sigma Prime and Nethermind, and on swBTC by ChainSecurity and Nethermind.

Two findings read differently now. In the 2023 Sigma Prime report, issue SWL2-01, rated medium, warned that bots were trusted to report both the rewards earned and the protocol’s whole ETH supply. A bot could therefore set swETH to a very high value, and future withdrawals could overpay. Swell fixed it with a minimum delay between repricings and upper and lower bounds on how far the rate can move from the previous one, the report says. That fits the 1% an hour ceiling researchers described in October 2026.

The Cyfrin report on Barracuda, dated 22 February 2024, rated its two medium findings on the same role. One showed the bot could quietly short-change every pending withdrawal by passing a processed rate of zero. Swell fixed both and Cyfrin verified the changes.

The post-mortem, as The Defiant reports it, describes the case SWL2-01 warned about: a trusted key feeding false balances into the rate. The bounds Swell added set the pace, about 1% a step by the researchers’ count, and did not stop it. An audit checks code at a given commit. It does not cover who holds the keys or how they are stored, and Sigma Prime’s disclaimer says it makes no judgement on the people behind a project. Swell’s site also shows Hexens among its auditors; we found no Hexens report on Swell in public.

swETH withdrawals reopened: status on 1 November 2026, 19:20 UTC

Coindaro covered the episode as it happened in our report on the swETH and rswETH freeze. Below, the facts are sorted by how firmly they are known.

What the contracts show

Both rates stood at 1.20297 ETH and 1.13768 ETH from 22 to 30 October. On 31 October they came down about 1% at a time between 07:59 and 14:18 UTC, in six steps for swETH and five for rswETH. Every step came from the same 4-of-7 Safe multisig, which holds the BOT role on both tokens.

At 10:46 UTC on 1 November one transaction from that multisig set the final rates of 1.133374 ETH and 1.082802 ETH, a cut of 5.79% and 4.82% from the inflated values, and switched the withdrawal pause off. The same transaction processed 17 swETH and 18 rswETH requests filed before the freeze, at the new rates, and sent 150.3 ETH and 13.1 ETH to the exit contracts to cover them.

Our own read at 19:17 UTC (Ethereum block 26,321,957) returned those same rates. A simulated direct deposit failed on both tokens with a paused error. The exit contracts were active: eight new swETH and three new rswETH withdrawal requests had been filed since 10:54 UTC, and 11 swETH and two rswETH withdrawals had been claimed.

Neither token has a new implementation. Their proxy slots still point to contracts deployed in March 2024 (swETH) and July 2024 (rswETH). The same read on the exit, deposit, oracle and access-control proxies of both tokens found no code deployed after April 2025, so none of the four upgrade contracts flagged by researchers was installed there.

How the pause began

Swell announced the pause on X at 06:39 UTC on 23 October. It said it was working with its security partners and Seal911, the Security Alliance’s emergency response group, to secure its infrastructure, and that it would resume deposits and withdrawals once NAV, the tokens’ net asset value, was back at the correct value. It set no date. Swell also said all funds were safe, as Unchained and TechFlow reported.

A day earlier, at 03:03 UTC on 22 October, Swell had said no ETH had left its deposit or withdrawal contracts.

During the freeze the market priced the tokens below their contracts. Unchained read the contracts at 20:48 UTC on 23 October and found about 1.203 ETH per swETH and 1.138 ETH per rswETH, roughly 6% and 5% above 1.133 and 1.082, the last rates the researcher Spreek considered clean. On decentralised exchanges swETH traded near 1.089 WETH in a Uniswap pool with about $143,000 of liquidity, and rswETH near 1.029 on Curve. The reset landed within 0.1% of those clean rates.

What Swell says, according to The Defiant

The article by The Defiant would load for us only as a summary line, so what follows comes from the copy republished by KuCoin. We could not read Swell’s posts on X. The news page on its website shows nothing after 28 April 2026, and its docs site refused our request. These are Swell’s claims at one remove.

The post-mortem says an attacker used a compromised operational key on 21 and 22 October to submit false balance reports, which inflated both rates. It says no ETH backing either token moved and no withdrawal was paid at the inflated rate. Requests made during the incident will be paid at the correct rate. The researcher Spreek had described a takeover of the keys on 22 October, before Swell gave any cause, as Crypto Briefing reported.

Those who lost out are depositors, who received too few tokens at the inflated rate. Swell counts 20 addresses and a combined shortfall of about 0.25 ETH, far below the 2,500 ETH researchers first feared. The Defiant says Swell “promises compensation within a week”, without naming the asset paid or a claim process; a second report, from ME News via KuCoin, also says within the coming week. Neither gives a calendar date.

The size of that figure can be tested. Blockscout lists 24 direct deposit calls on the two tokens between 14:25 UTC on 21 October and the pause, from 17 addresses, for about 4.0 ETH. Even at the full gap of 5.79% and 4.82% that comes to at most about 0.23 ETH. Deposits routed through other contracts are not in that count, so it supports the order of magnitude, not the exact 20 addresses.

Swell’s account said “Deposits and withdrawals are open”, The Defiant reports, while the control that blocks direct ETH deposits stayed on. Our simulated deposits at 19:17 UTC failed, so on that point the contracts contradict the post.

According to The Defiant, Swell warned borrowers in the Morpho msETH/rswETH market before the reset that the lower rate would bring their loans closer to liquidation, identified Metronome as the market’s curator and said third-party markets set their own pricing and risk parameters. That naming rests on The Defiant alone: we have no statement from Metronome, and Morpho’s API lists no vault supplying the market. The API showed about $700,000 supplied there on the evening of 1 November, almost all of it borrowed, with a 94.5% liquidation threshold. We did not check for liquidations.

What is still not known

Nothing we read says how the key was taken or who took it. Spreek reported on 22 October that an unknown party had taken Swell DAO’s operational hot keys, including the oracle bot, as of 14:25 UTC on 21 October; he said his report was written with AI help and not fully checked. Odysseas, founder of Phylax Systems, called it “BOT-key abuse”. Some posts linked the episode to a security disclosure by the cloud platform Railway on 21 October, but Railway’s notice does not mention Swell and the reports we read of the post-mortem give no such link.

The four upgrade contracts remain unexplained. Researchers said they could have swept about 2,500 ETH (Spreek) or 2,513 ETH (Odysseas) if pushed through Swell’s timelock, and Odysseas stressed that the sum “is NOT confirmed loss”. Spreek also said Aave, Spark and Fluid accepted neither token as of late 21 October. No lending venue has reported a loss in anything we read.

Beyond our own count of direct deposits, we have not seen anyone outside Swell check the 0.25 ETH figure, and we have no public statement from Seal911. We also do not know whether the compromised key has lost its role, or when direct deposits will return.

Is Swell Network safe? Our risk rating of 4 out of 5

Coindaro rates Swell 4 on a scale of 1 to 5, where 5 is the highest risk, and keeps that rating after the reopening. By Swell’s own account, as reported, one compromised operational key was enough to distort both token rates and freeze them for nine days, and we have not read a full technical account of it. TVL is down about 97% for swETH and 95% for rswETH from their peaks, direct deposits are still blocked, the L2 is closed, and the team now works on Faro while team and investor SWELL is released every month.

It is not a 5. The reported loss is about 0.25 ETH, the upgrade contracts flagged by researchers were never installed, withdrawals are moving again at the reset rates, the audits are public and we found no earlier exploit of Swell’s own contracts. A holder can now leave through the protocol’s two-step withdrawal or sell on a decentralised exchange, where pools were thin during the freeze.

What to watch next

Compensation comes first: Swell’s promise runs for a week from its 1 November statement, and a payout to the 20 addresses should show on-chain. Then direct deposits, which need the core pause lifted on both tokens. A full post-mortem from Swell should say how the key was taken and whether the old key has lost its role. On Swellchain, the pause L2BEAT logged is due to expire on 4 November.

Further out sit the SWELL status program for Faro, still undescribed six months after it was promised, and the team and investor unlocks, due to run until at least 2027.