# Swell freezes swETH and rswETH after suspected admin key compromise inflates their NAV · pwn.watch > On Oct 22 2026 researcher Spreek reported that the admin keys for Swell DAO's swETH and rswETH liquid staking tokens appeared to be compromised: the tokens' NAV was being raised without ETH backing, and four malicious upgrade contracts that could take about 2,500 ETH had been deployed but not yet queued through the multisig. Swell said no ETH had left its deposit or withdrawal contracts, then on Oct 23 at 06:39 UTC paused deposits, withdrawal requests and ETH claims for both tokens until NAV is returned to the correct value. Swell has not confirmed a key compromise or published a cause, and no reopening date has been given. Page: https://pwn.watch/i/swell-sweth-rsweth-admin-key-compromise-oct-2026 · generated 2026-10-24T12:01:54.353Z ## Status - Severity: high · status: live · patch: no-fix-needed - Product: Swell swETH and rswETH (Ethereum liquid staking / restaking tokens) - Started: 2026-10-22 - Affected: swETH (0xf951E335afb289353dc249e82926178EaC7DEd78); rswETH (0xFAe103DC9cf190eD75350761e95403b7b8aFa6c0) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/swell-sweth-rsweth-admin-key-compromise-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/swell-sweth-rsweth-admin-key-compromise-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/swell-sweth-rsweth-admin-key-compromise-oct-2026.json - This file: https://pwn.watch/i/swell-sweth-rsweth-admin-key-compromise-oct-2026/llms.txt ## Updates (newest first) - 2026-10-23: Swell pauses swETH and rswETH deposits, withdrawal requests and ETH claims (06:39 UTC), working with Seal911 until NAV is corrected; no reopening date. (https://x.com/swellnetworkio/status/2113520767665307910) - 2026-10-22: Researcher Spreek reports swETH/rswETH admin keys appear compromised, NAV raised by up to 1% an hour unbacked, and four malicious upgrade contracts deployed that could take ~2,500 ETH. (https://www.0xcert.com/advisory/0xCERT-2026-0262) - 2026-10-22: Swell says it is investigating reports of suspicious activity and that no ETH has left the swETH or rswETH deposit or withdrawal contracts. (https://cryptowatchdesk.com/news/swell-pauses-sweth-rsweth-deposits-withdrawals-nav-correction) ## Fix brief # Security brief: Swell freezes swETH and rswETH after suspected admin key compromise inflates their NAV Source: https://pwn.watch/i/swell-sweth-rsweth-admin-key-compromise-oct-2026 · status: live · severity: high · updated Oct 24, 2026, 09:58 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is On Oct 22 2026 researcher Spreek reported that the admin keys for Swell DAO's swETH and rswETH liquid staking tokens appeared to be compromised: the tokens' NAV was being raised without ETH backing, and four malicious upgrade contracts that could take about 2,500 ETH had been deployed but not yet queued through the multisig. Swell said no ETH had left its deposit or withdrawal contracts, then on Oct 23 at 06:39 UTC paused deposits, withdrawal requests and ETH claims for both tokens until NAV is returned to the correct value. Swell has not confirmed a key compromise or published a cause, and no reopening date has been given. Severity detail: ~2,500 ETH reported at risk; deposits and withdrawals frozen; no confirmed loss - Product: Swell swETH and rswETH (Ethereum liquid staking / restaking tokens) ## Affected versions - swETH (0xf951E335afb289353dc249e82926178EaC7DEd78) - rswETH (0xFAe103DC9cf190eD75350761e95403b7b8aFa6c0) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 23, 2026: Swell pauses swETH and rswETH deposits, withdrawal requests and ETH claims (06:39 UTC), working with Seal911 until NAV is corrected; no reopening date. - Oct 22, 2026: Researcher Spreek reports swETH/rswETH admin keys appear compromised, NAV raised by up to 1% an hour unbacked, and four malicious upgrade contracts deployed that could take ~2,500 ETH. - Oct 22, 2026: Swell says it is investigating reports of suspicious activity and that no ETH has left the swETH or rswETH deposit or withdrawal contracts. ## Advisories - [0xCERT-2026-0262: Swell swETH and rswETH admin keys suspected compromised; malicious upgrade contracts deployed](https://www.0xcert.com/advisory/0xCERT-2026-0262) (0xCERT) ## Write-ups & news - [Swell pauses swETH and rswETH deposits and withdrawals](https://cryptowatchdesk.com/news/swell-pauses-sweth-rsweth-deposits-withdrawals-nav-correction) - [Swell swETH pause: withdrawals frozen while NAV is fixed](https://www.coindaro.com/swell-sweth-rsweth-pause/) - [Swell Pauses swETH and rswETH Deposits and Withdrawals During NAV Fix](https://www.tokenpost.com/news/technology/39336) ## Caveats Swell has not used the words exploit, hack or key compromise; the compromise, the hourly NAV increases, the four upgrade contracts and the ~2,500 ETH figure come from researchers (Spreek, Phylax Systems). A link to the Railway env-var disclosure was raised by the researcher as a timing correlation only and is unconfirmed. Holders cannot redeem through Swell while paused; DEX prices trade below the inflated contract rate. --- Machine-readable: https://pwn.watch/i/swell-sweth-rsweth-admin-key-compromise-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.