Liquid staking protocol Swell moved to contain a security incident on October 23 by pausing deposits and withdrawals for its swETH and rswETH tokens, after researchers warned that operational hot keys had been used to push exchange rates higher without any new ETH backing. The pause followed a day of alarms, with Swell saying it was working with security partners including Seal911 to secure infrastructure and return net asset value to the correct level before reopening rails.
Security researcher Spreek reported on X at 01:28 UTC on October 22 that admin keys for both tokens appeared compromised. Attackers were “raising NAV by max 1% (unbacked) each hour,” Spreek wrote, while Phylax Systems founder Odysseus counted three swETH and two rswETH rate hikes of about 1% apiece. The protocol’s published oracle code restricts repricing snapshots to a bot role that runs on hot keys, meaning the signer can act automatically without human approval.
On-chain records show swETH snapshot submissions at 23:02 UTC on October 21 and again at 00:04 and 01:08 UTC on October 22. By October 22, swETH traded around 3.0% above its 1.133254 ETH reference rate, while rswETH was up about 2.0% from 1.082464 ETH. Researchers also flagged four malicious upgrade contracts targeting swEXIT, rswEXIT and deposit managers, which could have swept about 2,500 ETH if executed. Odysseus said Swell held 2,513 ETH and stressed the amount was “NOT confirmed loss,” adding that none of the upgrades had been run at the time of reporting.
The incident emerged hours after cloud platform Railway disclosed that an intruder may have accessed decrypted customer secrets, including API keys and registry credentials. Railway froze all deployments and urged users to rotate stored secrets. Crypto investigator Tay said an attacker had drained roughly $371,000 from wallets on at least 19 EVM chains with keys stored on Railway. Swell has not confirmed a link between the Railway breach and the hot-key compromise, and Spreek described the connection as speculative timing.
Swell initially said no ETH had left the swETH or rswETH withdrawal or deposit contracts and that no user action was needed. The October 23 update tightened the perimeter by halting deposits and withdrawals, warning users to treat phishing attempts as elevated. The protocol’s liquid staking and restaking products each held about $29 million in total value locked, while rswETH market cap estimates ranged from $27 million to $58 million. The risk highlights how distorted on-chain rates can flow into lending markets and secondary venues that rely on getRate() or similar pricing functions.
