TLDR:
Swell paused swETH and rswETH deposits and withdrawals at 2:39 a.m. ET on Friday, October 23.
The swETH contract reported about 1.203 ETH, roughly 6% above the last clean rate of 1.133 ETH.
On-chain analyst Spreek suspected compromised admin keys and found malicious upgrade contracts.
Swell stated that no ETH has left the affected contracts, but it gave no cause or reopening date.
Swell pauses swETH and rswETH deposits and withdrawals after the contracts reported abnormally high exchange rates. The Ethereum staking protocol announced the halt early Friday, October 23.
The swETH contract showed a rate near 1.203 ETH, while rswETH stood near 1.138 ETH. Both figures sit roughly 6% and 5% above normal levels.
Swell said no ETH has left the affected contracts. However, the team has not confirmed a cause or given a reopening date.
Exchange Rates Rise Above Normal Levels
Swell announced the pause at 2:39 a.m. ET on Friday. The team said its next step is returning the net asset value (NAV) of both tokens to the correct level. Deposits and withdrawals stay closed until then.
At 4:48 p.m. ET, Unchained’s read of the contracts showed swETH at about 1.203 ETH. The rswETH rate stood near 1.138 ETH. On-chain analyst Spreek had identified the last clean rates as 1.133 ETH and 1.082 ETH.
On decentralized exchanges, swETH traded near 1.089 WETH in a Uniswap pool with about $143,000 in liquidity. Meanwhile, rswETH traded near 1.029 WETH on Curve. Both market prices sit below the rates the contracts report.
According to DefiLlama, swETH holds about $29 million. The rswETH token holds roughly the same amount. So far, Swell has not offered guidance on trading or providing liquidity.
Admin Key Compromise Suspected, Cause Unconfirmed
Spreek posted on Wednesday, October 21, that admin keys for both tokens appeared compromised. He wrote that NAV was rising by “max 1% (unbacked) each hour” at the time.
He also identified four malicious upgrade contracts able to take about 2,500 ETH. None had been queued through Swell’s multisig.
Odysseus, founder of Phylax Systems, described the incident as “BOT-key abuse.” He added that the 2,513 ETH held “is NOT confirmed loss.” His comments came shortly after Spreek’s initial warning.
Swell responded at 11:03 p.m. ET that it was working with security partners. The team stated that “no ETH has left” the swETH or rswETH withdrawal or deposit contracts. It later wrote, “All funds are safe.” In addition, the team warned that such events can bring more phishing attempts.
Both researchers raised a possible link to Railway, a cloud deployment platform. Railway said in an October 21 disclosure that an “unauthorized third party” may have read some encrypted environment variables.
Its disclosure does not mention Swell, and Swell has not confirmed a connection. Spreek’s report, which he said was AI-written and not fully checked, found that Aave, Spark, and Fluid accepted neither token. A Morpho market had about 34 ETH available to borrow.
The post Swell Pauses swETH and rswETH Deposits and Withdrawals Over Inflated Exchange Rates appeared first on Blockonomi .
