Swell Halts swETH and rswETH Payouts After Rate Inflation

Swell halted deposits and withdrawals for its swETH and rswETH liquid staking tokens at 2:39 a.m. ET on Friday, October 23, after the contracts began reporting exchange rates well above their last clean levels, Blockonomi reported.

The swETH contract showed a rate near 1.203 ETH, about 6% above the previous clean figure of 1.133 ETH, while rswETH sat near 1.138 ETH, roughly 5% above 1.082 ETH. Swell said no ETH has left the affected contracts but has not stated a cause or given a date for reopening. Cryptobriefing reported that the rates were climbing at the fastest pace the system permits — 1% per hour — without any new ETH arriving to back them.

Key facts

• Swell stopped swETH and rswETH deposits and withdrawals at 2:39 a.m. ET on Friday, October 23.
• At 4:48 p.m. ET, swETH showed about 1.203 ETH and rswETH about 1.138 ETH against clean rates of 1.133 ETH and 1.082 ETH identified by analyst Spreek.
• Spreek flagged suspected compromise of admin keys on Wednesday, October 21, and identified four malicious upgrade contracts that could take about 2,500 ETH, none queued through Swell’s multisig.
• Odysseus, founder of Phylax Systems, called the incident “BOT-key abuse” and said the 2,513 ETH involved is not a confirmed loss, per Blockonomi.
• Swell said on-chain that no ETH had left the contracts and that all funds are safe.

Rates above clean levels

Spreek’s warning centred on the oracle mechanism that reports token exchange rates on-chain. Cryptobriefing reported that the unidentified actor took control of Swell DAO’s operational hot keys, including the oracle bot, as of 14:25 UTC on October 21, and that the increases ran at the system’s 1% hourly ceiling. The same report put swETH about 3.0% above 1.133254 ETH and rswETH roughly 2.0% above 1.082464 ETH by October 22, smaller margins than the figures Blockonomi cited at 4:48 p.m. ET on October 23.

Market prices diverged from the reported rates. In a Uniswap pool with about $143,000 in liquidity, swETH traded near 1.089 WETH, and rswETH traded near 1.029 WETH on Curve, both below the contract figures. According to DefiLlama, swETH and rswETH each hold roughly $29 million. Swell has not offered guidance on trading or providing liquidity.

Four upgrades loaded, none executed

Spreek identified four upgrade contracts that, if executed through Swell’s timelock, could sweep approximately 2,513 ETH from various contracts; Cryptobriefing reported they had been loaded but not fired. His report, which he said was AI-written and not fully checked, found that Aave, Spark and Fluid accepted neither token and that a Morpho market had about 34 ETH available to borrow.

Both researchers raised a possible link to Railway, a cloud deployment platform. Railway’s October 21 disclosure said an “unauthorized third party” may have read some encrypted environment variables. The disclosure does not name Swell, and Swell has not confirmed any connection. Swell also warned that incidents of this kind tend to draw more phishing attempts.

Why it matters

Liquid staking tokens underpin borrowing and collateral in DeFi, so a rate that overstates backing can ripple into any venue that prices these assets from the on-chain figure rather than the market. Cryptobriefing noted that no outside platforms had been drained. The episode also shows where liquid staking’s weak point sits: not only in contract code but in the hot keys and cloud services its automation runs on. Swell’s stated next step is restoring the net asset value of both tokens; deposits and withdrawals remain closed until then.

What to watch

Two signals will shape this story. The first is whether Swell’s governance can block or cancel the four queued upgrades through the timelock before they execute, which Cryptobriefing flagged as the decisive question for the roughly 2,513 ETH at stake. The second is an announcement from Swell on a confirmed cause and a reopening date.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: Blockonomi, Cryptobriefing