Swell swETH Pause Freezes Rails After Hot-Key Alarms

Liquid staking is supposed to turn ETH into a receipt you can trust. On Swell, the receipt rate started climbing without the ETH behind it.

Swell paused deposits and withdrawals for swETH and rswETH on October 23. It is working with security partners and Seal911 to secure infrastructure and return net asset value to the correct level, per the protocol’s official update. The Swell swETH pause follows a day of researcher alarms. Those alarms said admin and operational hot keys looked compromised. Unbacked rate markups hit the on-chain maximum. Upgrade contracts that could drain roughly 2,500 ETH had been staged but not queued.

That is the strange part of this crypto hacks story. The chain kept printing valid oracle snapshots. The backing did not keep up.

Researchers Flag Hot Keys and Staged Upgrades

On October 22, security researcher Spreek said admin keys for Swell DAO’s swETH and rswETH appeared compromised. Attackers were raising NAV by up to 1% per hour without backing, Spreek said. Four malicious upgrade contracts had been deployed. They were not yet queued through the multisig. Those contracts could steal about 2,500 ETH. Spreek linked a hot-key compromise incident write-up. Spreek warned that Claude had drafted parts of it. Some details remained unverified. The top-line on-chain claims still looked solid.

The report’s timeline puts the first anomalous activity at about 14:25 UTC on October 21. That is when the compromised oracle bot funded a deployer wallet. Later that day, gas was swept from dozens of Swell hot keys across Ethereum, Arbitrum, HyperEVM, and Base into a central attacker wallet. From 23:02 UTC, swETH and rswETH exchange rates began stepping up by 1% an hour. That is the contract maximum. No matching ETH arrived with the steps. Example markup transactions include swETH at 23:02 and rswETH at 23:35. The write-up also said the bot redirected EigenLayer rewards claimers for dozens of rswETH StakerProxies toward that wallet. Four upgrade payloads targeting swEXIT, rswEXIT, and the deposit managers would add a sweep path if ever installed.

A Railway platform link was floated as speculation only. Spreek said there was no hard proof. It looked like a timing coincidence.

Swell’s First Reply, Then the Freeze

Hours after the researcher posts, Swell said it was aware of suspicious activity on the swETH and rswETH contracts. The team was investigating with security partners. Swell stressed that no ETH had left the swETH or rswETH withdrawal or deposit contracts. Holders needed to take no action at that moment.

The October 23 follow-up tightened the perimeter. Deposits and withdrawals for both tokens were paused. Swell named Seal911 among its partners. It said all funds were safe. The next step before reopening rails was to reset NAV to the correct value. Swell also warned users to treat phishing as elevated and to trust only official channels.

Why the Swell swETH Pause Matters

Why did it matter? Because LST risk is not only a clever reentrancy. It is who holds the keys that move the rate.

swETH and rswETH are liquid staking and restaking receipts. When an oracle bot can mark the exchange rate higher without new ETH, secondary markets and lending venues that read getRate() inherit a distorted price. When upgrade payloads sit ready for a timelock, the next failure mode is a privileged install, not a retail phishing lure. Swell’s freeze stops new deposits and exits while partners try to unwind the unbacked markup and rotate compromised keys. That is containment language. It is not the same as saying the attack surface never opened.

For readers who track crypto scams and protocol heists together, the pattern is familiar. First the researcher thread. Then the “funds are safe” line. Then the pause. The psychology stays old. Trust the receipt. Then discover the receipt’s admin layer was hotter than the vault story sold.

New tech changes the surface of liquid staking. Compromised hot keys still write the next chapter.