Swell freezes swETH and rswETH after suspected admin key compromise inflates their NAV
Swell swETH and rswETH (Ethereum liquid staking / restaking tokens)
On Oct 22 2026 researcher Spreek reported that the admin keys for Swell DAO's swETH and rswETH liquid staking tokens appeared to be compromised: the tokens' NAV was being raised without ETH backing, and four malicious upgrade contracts that could take about 2,500 ETH had been deployed but not yet queued through the multisig. Swell said no ETH had left its deposit or withdrawal contracts, then on Oct 23 at 06:39 UTC paused deposits, withdrawal requests and ETH claims for both tokens until NAV is returned to the correct value. Swell has not confirmed a key compromise or published a cause, and no reopening date has been given.
Why this severity: ~2,500 ETH reported at risk; deposits and withdrawals frozen; no confirmed loss
- Started
- Oct 22, 2026
Affected
- swETH (0xf951E335afb289353dc249e82926178EaC7DEd78)
- rswETH (0xFAe103DC9cf190eD75350761e95403b7b8aFa6c0)
Fixed in
No fixed release yet
Timeline3
Swell pauses swETH and rswETH deposits, withdrawal requests and ETH claims (06:39 UTC), working with Seal911 until NAV is corrected; no reopening date.
Researcher Spreek reports swETH/rswETH admin keys appear compromised, NAV raised by up to 1% an hour unbacked, and four malicious upgrade contracts deployed that could take ~2,500 ETH.
Swell says it is investigating reports of suspicious activity and that no ETH has left the swETH or rswETH deposit or withdrawal contracts.
Advisories1
News & write-ups3
Posts1
As we continue to work with our security partners and Seal911 to fully secure our infrastructure, we have paused deposits and withdrawals for swETH and rswETH. The next step to resume normal operations is to return NAV to the correct value, after which we will resume deposits and withdrawals. All funds are safe, and we are working carefully with our security partners to resume operations securely. We advise you to exercise increased vigilance at this time and to follow only communications from official channels. Events like this can lead to an increase in phishing attempts.
Notes & caveats
Swell has not used the words exploit, hack or key compromise; the compromise, the hourly NAV increases, the four upgrade contracts and the ~2,500 ETH figure come from researchers (Spreek, Phylax Systems). A link to the Railway env-var disclosure was raised by the researcher as a timing correlation only and is unconfirmed. Holders cannot redeem through Swell while paused; DEX prices trade below the inflated contract rate.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
