Swell DAO paused deposits and withdrawals for swETH and rswETH on October 23, 2026, after compromised hot keys for an automated repricing bot manipulated on-chain exchange rates upward by up to 6%. Security researchers linked the key leak to an October 21 unauthorized intrusion at cloud platform Railway. While four malicious upgrade contracts targeting 2,500 ETH were deployed, Swell confirmed no ETH was stolen from its $58 million in liquid staking pools.
Swell DAO response and asset safety
- ▪Swell DAO paused deposits and withdrawals for swETH and rswETH tokens on October 23, 2026, stating operations would remain frozen until net asset values return to correct values
- ▪Swell DAO stated on October 22, 2026 that no ETH had left the swETH or rswETH deposit or withdrawal contracts, holding approximately $29 million in total value locked in each product
Security findings on protocol attack vectors
- ▪Security researcher Spreek and Phylax Systems founder Odysseus reported on October 21, 2026 that an unauthorized actor compromised operational hot keys for Swell DAO's automated repricing bot
- ▪Security researcher Spreek identified four unexecuted malicious upgrade contracts deployed against Swell DAO's protocol that could have stolen approximately 2,500 ETH
Inflation of swETH and rswETH exchange rates
- ▪On-chain data on October 22, 2026 showed Swell DAO's swETH liquid staking token exchange rate inflated by approximately 3.0% to 6.0% above the clean rate of 1.133254 ETH identified by security researcher Spreek
- ▪On-chain data on October 22, 2026 showed Swell DAO's rswETH liquid restaking token exchange rate inflated by approximately 2.0% to 5.0% above its clean rate of 1.082464 ETH
- ▪Ethereum records from October 21 and October 22, 2026, tracked by security researcher Spreek, show three separate rate updates raising Swell DAO's swETH token net asset value by approximately 1% per hour without additional ETH backing
- ▪Unbacked net asset value rate increases raised Swell DAO's rswETH exchange rate to approximately 1.138 ETH by October 23, 2026
Impact on DEXs and lending markets
- ▪Following Swell DAO's exchange rate manipulation, security analysis showed a Morpho lending market using contract-reported rates had approximately 34 ETH available to borrow against inflated collateral values
- ▪Decentralized exchanges Uniswap and Curve priced Swell DAO's swETH and rswETH tokens significantly below the inflated rates reported by Swell DAO's smart contracts on October 23, 2026
Railway breach and wallet drains
- ▪On October 21, 2026, crypto investigator Tay reported that an attacker drained approximately $371,000 from wallets across at least 19 EVM chains using private keys stored on Railway
- ▪Cloud deployment platform Railway announced on October 21, 2026 that an unauthorized third party accessed systems storing customer environment variables, potentially compromising stored API keys and registry credentials
Story comments
Loading comments…