Swell has paused deposits and withdrawals for its two Ethereum staking tokens, swETH and rswETH, the team said on X at 06:39 UTC on Friday 23 October. It wants to bring the tokens’ exchange rate, their net asset value (NAV), “to the correct value” before reopening, and it gave no date. The pause comes about 29 hours after security researchers said the tokens’ admin keys appeared to be compromised and that someone was pushing the rate up without ETH behind it. Swell has not said what happened. It says no ETH has left its deposit or withdrawal contracts.
At stake, by the researchers’ count, is about 2,500 ETH, roughly $6.0 million with ETH near $2,398 at 10:28 UTC on 23 October. No loss has been reported. Swell’s two products held about $29 million each on DefiLlama on Friday morning.
In its post, Swell said it was working with “our security partners and Seal911” to “fully secure our infrastructure”, and that “we have paused deposits and withdrawals for swETH and rswETH.” The next step, it wrote, “is to return NAV to the correct value”, after which it will resume deposits and withdrawals. According to a TechFlow summary of the announcement published at 08:01 UTC, Swell also said all funds are currently secure and told users to watch for phishing and to rely only on its official channels.
What the Swell swETH pause blocks, and what it does not say
The freeze is on-chain. The Defiant, which filed its report under its Hacks section, wrote that on-chain controls now block withdrawal requests and ETH claims, and that Swell must correct NAV before reopening. So a holder of swETH or rswETH cannot, for now, start a withdrawal back to ETH through Swell, and a withdrawal already requested cannot be claimed.
No post-mortem is out yet, and neither is a list of affected contract addresses, a transaction hash or anything on the cause. The team has not used the words exploit, hack or key compromise. It has not said who will reset the rate, how, or whether that needs a multisig or DAO vote. As of 10:50 UTC on 23 October no reopening date had been given.
Whether the tokens can still be swapped on decentralised exchanges, and at what price, could not be checked for this article. We found no reliable market price for swETH or rswETH to quote.
Researchers say an admin key leaked and the rate was raised without backing
The first public alarm came from Spreek, a DeFi researcher who posts as @spreekaway, at 01:28 UTC on 22 October. “Admin keys for Swell DAO’s swETH and rswETH appear to be compromised (railway related?)”, he wrote. He added that attackers were raising NAV “by max 1% (unbacked) each hour”, and that four malicious upgrade contracts had been deployed, not yet queued through the multisig, that could take about 2,500 ETH.
If those contracts are what Spreek says they are, they matter more than the rate itself. In a proxy setup, the token address users hold stays the same while the code behind it can be swapped for a new version. According to KuCoin’s flash report, another researcher, ADL (@ADLXBT), said the leaked key gives proxy-admin rights, so an attacker could point the proxy at a malicious implementation and call mint or withdraw functions. When he posted, Spreek said, none of the four had yet been queued through the multisig.
How the rate was raised, according to Phylax Systems
Odysseus, founder of the security firm Phylax Systems, gave the most detailed account, reported by Cryptopolitan. He counted five increases of about 1% each: three on swETH and two on rswETH. Ethereum records cited in that report show one address submitting swETH rate snapshots at 23:02 UTC on 21 October, then again at 00:04 and 01:08 UTC on 22 October.
Swell’s published blockchain (oracle) è un servizio che fornisce dati esterni, come prezzi degli asset, tassi di interesse, risultati sportivi o meteo, agli smart contract, che da soli non possono accedere a informazioni fuori dalla propria blockchain.">oracle code, he said, lets only one role, called BOT, submit those repricing snapshots. He called the episode “BOT-key abuse”. By his figures, on 22 October swETH stood about 3.0% above its earlier rate of 1.133254 ETH, and rswETH about 2.0% above 1.082464 ETH.
He estimated Swell’s holdings at 2,513 ETH and was careful to add that the amount “is NOT confirmed loss.” Only part of the higher rate, he said, had shown up in wallet senza affidare la custodia dei fondi a una società.">DEX prices.
These are claims from named researchers, not findings Swell has confirmed. Both outlets flag a weakness in the research itself: KuCoin, relaying TechFlow, says Spreek’s incident report was generated with an AI model and is partly unverified, and Cryptopolitan says some details were compiled with AI help. No transaction hashes were published with the figures. We did not find a post on Swell from PeckShield, Cyvers, CertiK or another monitoring firm; Seal911 appears only as Swell’s partner.
Swell said on 22 October that no ETH had left its contracts
Swell’s first public word came at 03:03 UTC on 22 October, about 95 minutes after Spreek’s post. “No ETH has left the swETH or rswETH withdrawal or deposit contracts,” the team wrote in a post on X, saying it was investigating with security partners and that no action was required from users. The protocol stayed open that day.
More than a day later it changed course and shut deposits and withdrawals. Swell has not explained why. One plausible reading of its own words is mechanical: if the rate is wrong, letting people withdraw at that rate would pay out ETH that is not backed, and letting people deposit would hand them fewer tokens than they are owed. That is our inference from the wording, not Swell’s statement.
| Time (UTC) | Event | Source |
|---|---|---|
| 21 Oct | Railway discloses access to systems storing customer environment variables | Railway |
| 21 Oct, 23:02 | An address submits a swETH rate snapshot | Cryptopolitan, citing Odysseus |
| 22 Oct, 00:04 and 01:08 | Two more snapshots from the same address | Cryptopolitan, citing Odysseus |
| 22 Oct, 01:28 | Spreek says the admin keys appear compromised | X post by @spreekaway |
| 22 Oct, 03:03 | Swell says it is investigating and no ETH has left its contracts | X post by @swellnetworkio |
| 23 Oct, 06:39 | Swell pauses deposits and withdrawals until NAV is corrected | X post by @swellnetworkio |
The Railway link is a guess, and Spreek says so
Spreek’s question mark points at Railway, the app-hosting platform. On 21 October Railway disclosed anomalous activity on systems that store its customers’ environment variables, said some encrypted values may have been read and some decrypted, paused deployments and told every user to roll API keys and other credentials. A crypto investigator known as Tay then tied about $371,000 of thefts on at least 19 EVM chains to keys kept on Railway, as we reported in our piece on the Railway breach and the $370,000 crypto theft.
Nothing published so far connects Swell to Railway. Spreek himself, according to KuCoin and ChainCatcher, called the link speculative, only a timing coincidence, with no concrete evidence. Swell has not said where its keys were kept.
Swell TVL stayed near $29 million per product
If holders were rushing for the exit, it does not show in the data. DefiLlama put Swell Liquid Staking, the swETH product on Ethereum, at $29,053,814 at 09:45 UTC on 23 October, after $28.25 million on 21 October and $29.09 million on 22 October. Its one-day change was -1.26%. Swell Liquid Restaking, behind rswETH, stood at $29,189,120, down 0.74% on the day.
Two caveats apply. A frozen protocol cannot see outflows through its own contracts, so steady TVL after the pause says little about demand. And DefiLlama values the tokens partly from the on-chain rate, which researchers say was pushed up, so we do not treat the figure as a measure of backing. Swell’s smaller products are far below these levels: Swell L2 Farm at $1.84 million, Swell Earn at $0.51 million, its bitcoin restaking token at $0.47 million and the Swellchain bridge at $0.34 million.
| Swell product (DefiLlama) | TVL, 23 Oct | 1-day change |
|---|---|---|
| Liquid Staking (swETH) | $29.05 million (09:45 UTC) | -1.26% |
| Liquid Restaking (rswETH) | $29.19 million | -0.74% |
| L2 Farm | $1.84 million | n/a |
| Earn | $0.51 million | n/a |
| BTC LRT | $0.47 million | n/a |
| Swellchain Bridge | $0.34 million | n/a |
Why an inflated rate matters beyond Swell
swETH is a liquid staking token: you deposit ETH, the protocol stakes it, and you get a token whose value in ETH rises as rewards come in. rswETH does the same with restaking on top. The exchange rate is the whole promise. It tells every app how much ETH one token is worth.
That is why Odysseus pointed at lending. A lending market that prices swETH or rswETH from the on-chain rate, rather than from trading prices, would treat the inflated value as real collateral. Someone holding the tokens could then borrow more than their ETH backing supports. We found no lending market, on Aave, Morpho or elsewhere, announcing a freeze of swETH or rswETH or saying it has exposure. That means we do not know, not that there is none.
The risk is not theoretical this year. On 18 April 2026 an attacker minted unbacked rsETH, Kelp DAO’s restaking token, through a LayerZero bridge flaw and used it as collateral on Aave. Blockworks Research estimated Aave’s bad debt at between $124 million and $230 million, with Morpho exposure of about $1 million, and the case is still discussed on Aave’s governance forum. Nothing shows the same has happened with Swell’s tokens.
What swETH and rswETH holders can do now
Very little, by design. Swell said on 22 October that no action was needed, and on 23 October, per TechFlow, warned users about phishing and asked them to use official channels only. Incidents like this draw fake “claim” and “migration” sites, so any link promising an early withdrawal deserves suspicion.
Developers who run anything on Railway have their own task, whatever the outcome at Swell. Railway’s advice is to roll all stored environment variables, API keys and registry credentials and to review logs. Most crypto losses come from keys and contract permissions rather than from the blockchain itself, as our explainer on where crypto hacks really happen sets out.
Open questions before Swell reopens
Reopening hangs on one undated step, the NAV correction. Several things would change how this story reads once it does.
- What the correct NAV is, and whether Swell resets both tokens to the rates researchers cited, 1.133254 ETH and 1.082464 ETH, or to something else.
- Whether the four upgrade contracts Spreek described exist, who controls them and whether the keys behind them have been rotated.
- Where the compromised key, if there was one, was stored, and whether Railway had anything to do with it.
- Whether any lending market or DEX pool took the inflated rate, and who would bear a loss if one did.
The next sign to watch is a post-mortem or a governance post from Swell naming the cause and the method of the fix. As of 10:50 UTC on Friday, neither had appeared.