Swell pauses swETH and rswETH deposits and withdrawals amid inflated contract rates
Ethereum staking protocol Swell has halted deposits and withdrawals for swETH and rswETH until it corrects artificially inflated token exchange rates linked to suspected admin key tampering.
Ethereum staking protocol Swell paused deposits and withdrawals for its swETH and rswETH tokens early Friday, announcing that the freeze will remain in place until net asset values are brought back to their proper levels. By Friday afternoon, the swETH contract reflected an exchange rate of roughly 1.203 ETH, while rswETH reached approximately 1.138 ETH. Those figures were about 6% and 5% higher than normal benchmark rates of 1.133 ETH and 1.082 ETH, even as decentralized exchange pools on Uniswap and Curve traded the tokens closer to 1.089 WETH and 1.029 WETH, respectively.[2][1][3]
The rate distortion followed on-chain anomalies first flagged on Wednesday night. According to on-chain analyst Spreek, admin keys for both assets appeared compromised, allowing the net asset value to increase by up to 1% unbacked per hour. Spreek also identified malicious upgrade contracts capable of taking around 2,500 ETH, although none had been queued or executed through Swell's multisig wallet. Odysseus, founder of Phylax Systems, described the incident as potential bot-key abuse and noted the funds were not a confirmed loss.[2][1]
Swell told users that all funds remain safe and verified that no ETH has departed either token's deposit or withdrawal contracts. Both Spreek and Odysseus pointed to a potential link with cloud deployment service Railway, which disclosed on Wednesday that an unauthorized party may have accessed customer environment variables. However, Railway's notice did not cite Swell, and Swell stated that the precise cause remains under investigation.[2][1]
Key facts
- Swell paused deposits and withdrawals for swETH and rswETH at 2:39 a.m. ET on Friday until their net asset values are corrected.
- The contract exchange rates rose to about 1.203 ETH for swETH and 1.138 ETH for rswETH, roughly 6% and 5% above the baseline clean rates identified by Spreek.
- On-chain analyst Spreek reported that admin keys appeared compromised on Oct. 21 and inflated the NAV by up to 1% unbacked per hour.
- Malicious upgrade contracts capable of siphoning around 2,500 ETH were deployed but were not queued through Swell's multisig.
- Swell confirmed that no ETH had left the swETH or rswETH deposit or withdrawal contracts, stating that funds remain safe while the cause is investigated.
- Security researchers raised a potential link to an Oct. 21 environment variable breach disclosed by Railway, though Swell has not confirmed this connection.
Sources · 3 sources
- WB
Wu Blockchain@WuBlockchainPost on X ·
Swell Pauses swETH and rswETH Deposits and Withdrawals Amid Abnormally High Contract Exchange Rates According to Unchained, Ethereum staking protocol Swell has paused deposits and withdrawals for swETH and rswETH until it corrects the net asset values (NAV) and exchange rates of both tokens. Data shows that the swETH and rswETH contracts reported exchange rates of approximately 1.203 ETH and 1.138 ETH, respectively, about 6% and 5% higher than normal levels. On-chain analyst Spreek suspected a compromise of the relevant token admin keys and identified a malicious upgrade contract that could potentially impact around 2,500 ETH, though the upgrade has not yet been executed. Swell stated that no ETH has been transferred out of the affected contracts and that the exact cause remains under investigation.
Open source - UN
UnchainedArticle ·
Swell Freezes swETH and rswETH Withdrawals Until It Corrects Their Exchange Rates Holders of Swell ‘s swETH and rswETH cannot deposit or withdraw through the protocol after the team said at 2:39 a.m. ET Friday it had paused both tokens’ deposits and withdrawals. Swell wrote that returning their net asset value (NAV) “to the correct value” is the next step before it reopens them. At 4:48 p.m. ET Friday, the swETH contract put its rate at about 1.203 ETH and rswETH at about 1.138 ETH , according to Unchained’s read of the contracts. Those figures sit roughly 6% and 5% above the last rates that on-chain analyst Spreek identified as clean, 1.133 ETH and 1.082 ETH. On decentralized exchanges, swETH fetched about 1.089 WETH in a Uniswap pool with roughly $143,000 of liquidity, and rswETH went for about 1.029 WETH on Curve. According to DefiLlama, swETH holds about $29 million and rswETH holds roughly the same . Swell has not given a reopening timeline or guidance on trading or providing liquidity. “All funds are safe,” the team wrote, and it warned that events like this can bring more phishing attempts. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . How the rates rose At 9:28 p.m. ET on Wednesday, Oct. 21, Spreek wrote that admin keys for both tokens appeared to be compromised and that NAV was being raised by “max 1% (unbacked) each hour” at the time. He said four malicious upgrade contracts able to take about 2,500 ETH had been deployed, but none had been queued through Swell’s multisig. Odysseus, founder of Phylax Systems, said the incident looked like “BOT-key abuse” and stressed that the 2,513 ETH held “is NOT confirmed loss.” Swell said at 11:03 p.m. ET that it was investigating with security partners and that “no ETH has left the swETH or rswETH withdrawal or deposit contracts.” Cause still unconfirmed Both researchers raised a possible tie to Railway, a cloud deployment platform. Railway said in an Oct. 21 security disclosure that an “unauthorized third party” may have gotten into customers’ encrypted environment variables and read some of them in decrypted form. Railway’s disclosures do not mention Swell, and Swell has not confirmed a link or described the cause. Spreek’s incident report, which he said was AI-written and not fully checked, found that as of late Oct. 21 none of Aave, Spark or Fluid accepted either token and that a Morpho market priced off the contract rate had about 34 ETH available to borrow. In April, LayerZero linked a $292 million exploit of the bridge for Kelp DAO’s rsETH restaking token to North Korea’s Lazarus Group, and Kelp DAO later sued LayerZero over it. Related Listen: How Spark Escaped the KelpDAO Hack Before It Even Happened The post Swell Freezes swETH and rswETH Withdrawals Until It Corrects Their Exchange Rates appeared first on Unchained .
Open source - LS
Laura Shin@laurashinPost on X ·
swETH's contract rate read about 1.203 ETH on Friday afternoon, while a Uniswap pool priced it near 1.089 WETH. Swell says the rate needs correcting and has paused redemptions until then. https://t.co/cYq3joUBic
Open source