Swell has paused deposits and withdrawals for swETH and rswETH through its protocol, saying it needs to return the tokens’ net asset value, or NAV, to the correct level before reopening those functions.
The team said at 2:39 a.m. ET on Friday that both tokens had been paused. As of 4:48 p.m. ET Friday, Unchained’s reading of the contracts showed the swETH rate at about 1.203 ETH and the rswETH rate at about 1.138 ETH.
Those levels were still above the last rates that on-chain analyst Spreek identified as clean: 1.133 ETH for swETH and 1.082 ETH for rswETH. That puts the contract rates roughly 6% and 5% higher, respectively.
On decentralized exchanges, swETH was trading at about 1.089 WETH in a Uniswap pool with roughly $143,000 of liquidity, while rswETH was changing hands at about 1.029 WETH on Curve. According to DefiLlama, swETH holds about $29 million and rswETH holds roughly the same amount.
Swell has not given a timeline for reopening deposits and withdrawals. It also has not offered guidance on trading the tokens or providing liquidity. The team said all funds are safe and warned users that incidents like this can lead to more phishing attempts.
How the rates moved higher
At 9:28 p.m. ET on Wednesday, Oct. 21, Spreek wrote that the admin keys for both tokens appeared to be compromised. He said NAV was being increased by as much as 1% per hour at the time without backing. He also said four malicious upgrade contracts capable of taking about 2,500 ETH had been deployed, though none had been queued through Swell’s multisig.
Odysseus, founder of Phylax Systems, said the incident looked like bot-key abuse. He added that the 2,513 ETH being held is “NOT confirmed loss.”
At 11:03 p.m. ET, Swell said it was investigating the matter with security partners and that no ETH had left the swETH or rswETH withdrawal or deposit contracts.
Cause remains unconfirmed
Both researchers pointed to a possible connection to Railway, a cloud deployment platform. In a security disclosure dated Oct. 21, Railway said an unauthorized third party may have accessed customers’ encrypted environment variables and read some of them in decrypted form.
Railway’s disclosure did not mention Swell, and Swell has not confirmed any link or described the cause of the incident.
Spreek also said his incident report was AI-written and not fully checked. That report said that as of late Oct. 21, neither Aave, Spark, nor Fluid accepted either token. It also said a Morpho market priced off the contract rate had about 34 ETH available to borrow.
In April, LayerZero linked a $292 million exploit involving the bridge for Kelp DAO’s rsETH restaking token to North Korea’s Lazarus Group. Kelp DAO later sued LayerZero over that incident.