Swell Freezes swETH and rswETH Withdrawals After Suspected Key Compromise

Swell paused deposits and withdrawals for its swETH and rswETH tokens on Friday to return their net asset value (NAV) to the correct level, after their contract exchange rates were pushed to about 1.203 ETH and 1.138 ETH—roughly 6% and 5% above the last rates identified as clean (1.133 ETH and 1.082 ETH). According to DefiLlama data cited by Unchained, swETH holds about $29M and rswETH holds roughly the same amount, while secondary decentralized exchange markets priced swETH at about 1.089 WETH in a Uniswap pool with roughly $143k of liquidity and rswETH at about 1.029 WETH on Curve.

On-chain analyst Spreek reported on Oct. 21 that admin keys for both tokens appeared compromised, pushing NAV up by a maximum of 1% unbacked each hour, and noted that four malicious upgrade contracts capable of taking about 2,500 ETH had been deployed without being queued through Swell's multisig. Both Spreek and Phylax Systems founder Odysseus suggested a potential connection to cloud deployment platform Railway, which disclosed on Oct. 21 that an unauthorized third party may have accessed and read some customers' decrypted environment variables, though Swell has not confirmed a link or detailed the root cause. "All funds are safe," — Swell Team.