Verify a decision

{"actor":"system:backfill","investigation_id":"72a232fc-b734-4baf-a413-fadedb68e130","kind":"publish","page_slug":"swell-network-sweth-rsweth","published_at":"2026-10-28T04:34:10.117Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Swell Network (swETH / rswETH)","sections":[{"content":"On October 21, 2026, security researcher Spreek reported that an unidentified actor had taken control of Swell DAO's operational hot keys, including the oracle bot responsible for setting the exchange rates of swETH and rswETH, as of 14:25 UTC that day. According to the reporting, the compromised keys were used to raise both tokens' exchange rates at the system's maximum permitted rate of 1% per hour, without any new ETH being added to back the increase. By October 22-23, swETH's on-chain rate was reported at roughly 3-6% above its last clean reference rate of approximately 1.133254 ETH (reported figures vary by source and snapshot time, ranging from about 1.203 ETH to smaller premiums), and rswETH was reported at roughly 2-5% above its last clean reference rate of approximately 1.082464 ETH. Independent researcher Odysseus of Phylax Systems described the episode as 'bot-key abuse' and stated that an amount of roughly 2,513 ETH held in affected contracts was exposed but 'is NOT confirmed loss.' Swell has stated that no ETH has left the affected swETH or rswETH deposit or withdrawal contracts, and that 'all funds are safe,' though it has not independently confirmed the attacker's identity, the precise mechanism of compromise, or a timeline for resolution. Spreek has himself cautioned that his report was partly AI-assisted and not fully independently verified, which lowers confidence in some specific figures (e.g., the exact percentage premiums differ between outlets).","heading":"Active security incident: alleged hot/admin key compromise and unbacked rate inflation","severity":"critical","sources":[{"credibility":2,"name":"Researchers flag inflated swETH and rswETH rates after Swell hot key compromise - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/swell-sweth-rsweth-inflated-rates-hot-keys/"},{"credibility":2,"name":"Swell pauses swETH and rswETH deposits and withdrawals over inflated exchange rates - Blockonomi","type":"news_article","url":"https://blockonomi.com/swell-pauses-sweth-and-rsweth-deposits-and-withdrawals-over-inflated-exchange-rates/"},{"credibility":2,"name":"Researchers flag inflated swETH and rswETH rates after Swell hot key compromise - PrimeXBT","type":"news_article","url":"https://primexbt.com/news/researchers-flag-inflated-sweth-and-rsweth-rates-after-swell-hot-key-compromise/"}]},{"content":"Reporting attributed to researcher Spreek states that four malicious upgrade contracts were deployed targeting Swell's infrastructure, which, if executed through Swell's governance timelock, could sweep approximately 2,513 ETH (reported as roughly $8-9 million depending on ETH price at the time) from various protocol contracts. As of the most recent reporting (October 22-24, 2026), these contracts had not been executed, and Swell stated that no ETH had actually left the affected contracts. The 2,513 ETH figure represents disclosed exposure rather than a confirmed loss, and no outlet has reported that funds were ultimately drained as of this writing. This should be treated as an evolving, unresolved figure pending further disclosure from Swell or independent on-chain analysis.","heading":"Malicious upgrade contracts and funds at risk (approx. 2,513 ETH, unexecuted)","severity":"critical","sources":[{"credibility":2,"name":"Researchers flag inflated swETH and rswETH rates after Swell hot key compromise - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/swell-sweth-rsweth-inflated-rates-hot-keys/"},{"credibility":2,"name":"Swell pauses swETH and rswETH deposits and withdrawals over inflated exchange rates - Blockonomi","type":"news_article","url":"https://blockonomi.com/swell-pauses-sweth-and-rsweth-deposits-and-withdrawals-over-inflated-exchange-rates/"}]},{"content":"Swell paused deposits and withdrawals for both swETH and rswETH at approximately 2:39 a.m. ET on October 23, 2026 (Friday), after on-chain data showed the tokens' exchange rates had drifted well above the ETH actually backing them. Swell, via its official X (Twitter) account (@swellnetworkio), stated it is working with security partners, including incident-response firm Seal911, to investigate and secure its infrastructure, and said the next step is to restore the tokens' net asset value (NAV) to the correct level before resuming deposits and withdrawals. Swell warned users that such incidents often lead to an increase in phishing attempts and urged reliance only on official channels. As of the most recent reporting available (October 24-25, 2026), Swell had not given a specific timeline for reopening deposits and withdrawals, and no subsequent reporting confirming a reopening has been found.","heading":"Swell's response: deposits and withdrawals paused, no timeline given","severity":"high","sources":[{"credibility":2,"name":"Swell Network Halts swETH and rswETH Withdrawals After Leaked Railway Key Causes Unbacked Rate Hikes - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/swell-network-halts-sweth-and-rsweth-withdrawals-after-leaked-railway-key-causes-unbacked-rate-hikes"},{"credibility":2,"name":"Swell pauses swETH and rswETH deposits and withdrawals over inflated exchange rates - Blockonomi","type":"news_article","url":"https://blockonomi.com/swell-pauses-sweth-and-rsweth-deposits-and-withdrawals-over-inflated-exchange-rates/"}]},{"content":"Several outlets, including KuCoin's news flash (republishing reporting originally attributed to a social media account and secondary outlets) and Cryptopolitan, have reported a possible link between the Swell key compromise and a disclosure by Railway, a cloud deployment platform used in parts of Swell's infrastructure, that an unauthorized third party may have accessed decrypted customer environment variables around October 21, 2026. However, this link is explicitly described by researchers, including Spreek, as speculative and based on timing coincidence rather than confirmed causation. Swell itself has not confirmed any connection to Railway, and no outlet reviewed has explained the precise technical mechanism by which an alleged Railway key leak would have enabled control of Swell's oracle or admin keys. This claim should be treated as unverified and low-to-medium confidence pending an official post-mortem from Swell or Railway.","heading":"Unconfirmed reported link to Railway cloud-platform key leak","severity":"medium","sources":[{"credibility":2,"name":"Swell Network Halts swETH and rswETH Withdrawals After Leaked Railway Key Causes Unbacked Rate Hikes - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/swell-network-halts-sweth-and-rsweth-withdrawals-after-leaked-railway-key-causes-unbacked-rate-hikes"},{"credibility":2,"name":"Researchers flag inflated swETH and rswETH rates after Swell hot key compromise - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/swell-sweth-rsweth-inflated-rates-hot-keys/"}]},{"content":"Swell Network is an Ethereum liquid staking and liquid restaking protocol. Users deposit ETH to receive swETH, a liquid staking token representing staked ETH, which can in turn be deposited into Swell's restaking product to receive rswETH, a liquid restaking token representing ETH restaked via EigenLayer-style mechanisms. Reported total value locked figures for Swell have varied widely over time; a 2024 report cited approximately $455.6 million TVL via DeFi Llama, while reporting around the October 2026 incident cited Swell's TVL at roughly $29.4 million, suggesting a substantial decline in deposits prior to or coinciding with the incident, though this has not been independently verified against a single consistent data source.","heading":"Background: what Swell Network is","severity":"low","sources":[{"credibility":2,"name":"Swell Launches Liquid Restaking Token As LRTs Boom - The Defiant","type":"news_article","url":"https://thedefiant.io/news/defi/swell-launches-liquid-restaking-token-as-lrts-boom"},{"credibility":2,"name":"Researchers flag inflated swETH and rswETH rates after Swell hot key compromise - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/swell-sweth-rsweth-inflated-rates-hot-keys/"}]}],"sources_used":[{"credibility":2,"name":"Researchers flag inflated swETH and rswETH rates after Swell hot key compromise - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/swell-sweth-rsweth-inflated-rates-hot-keys/"},{"credibility":2,"name":"Swell Network Halts swETH and rswETH Withdrawals After Leaked Railway Key Causes Unbacked Rate Hikes - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/swell-network-halts-sweth-and-rsweth-withdrawals-after-leaked-railway-key-causes-unbacked-rate-hikes"},{"credibility":2,"name":"Swell pauses swETH and rswETH deposits and withdrawals over inflated exchange rates - Blockonomi","type":"news_article","url":"https://blockonomi.com/swell-pauses-sweth-and-rsweth-deposits-and-withdrawals-over-inflated-exchange-rates/"},{"credibility":2,"name":"Researchers flag inflated swETH and rswETH rates after Swell hot key compromise - PrimeXBT","type":"news_article","url":"https://primexbt.com/news/researchers-flag-inflated-sweth-and-rsweth-rates-after-swell-hot-key-compromise/"},{"credibility":2,"name":"Swell Launches Liquid Restaking Token As LRTs Boom - The Defiant","type":"news_article","url":"https://thedefiant.io/news/defi/swell-launches-liquid-restaking-token-as-lrts-boom"}],"summary":"Swell Network is an Ethereum liquid staking and liquid restaking protocol whose tokens, swETH and rswETH, are at the center of an active, unresolved security incident first flagged on October 21, 2026. Researchers reported that an unidentified actor gained control of Swell's operational admin/oracle keys and pushed the tokens' on-chain exchange rates up at the maximum allowed rate with no corresponding ETH backing, and that malicious upgrade contracts capable of sweeping roughly 2,513 ETH were deployed but had not executed as of the most recent reporting. Swell paused all swETH/rswETH deposits and withdrawals on October 23, 2026 pending restoration of the correct net asset value, has not confirmed a cause (including an unverified reported link to a Railway cloud-platform key leak), and has given no timeline for reopening.","timeline":[{"date":"2026-10","date_evidence":"the actor reportedly had control of the keys 'as of 14:25 UTC on October 21'","date_original":"2026-10-21","event":"Security researcher Spreek reports that an unidentified actor took control of Swell DAO's operational hot keys, including the oracle bot setting swETH/rswETH exchange rates, as of 14:25 UTC.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/swell-sweth-rsweth-inflated-rates-hot-keys/"},{"date":"2026-10","date_original":"2026-10-21","event":"Cloud platform Railway discloses that an unauthorized third party may have accessed decrypted customer environment variables; some researchers later flag a possible but unconfirmed timing link to the Swell incident.","source":"Blockonomi","source_url":"https://blockonomi.com/swell-pauses-sweth-and-rsweth-deposits-and-withdrawals-over-inflated-exchange-rates/"},{"date":"2026-10-22","date_evidence":"Spreek reported 'on October 22, 2026 that an unidentified actor had reportedly taken control' of Swell's keys","event":"Crypto Briefing publishes reporting on the alleged hot key compromise, citing swETH trading roughly 3% above its 1.133254 ETH reference rate and rswETH roughly 2% above its 1.082464 ETH reference rate.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/swell-sweth-rsweth-inflated-rates-hot-keys/"},{"date":"2026-10","date_evidence":"Swell announced the pause at '2:39 a.m. ET on Friday,' dated to Friday, October 23","date_original":"2026-10-23","event":"Swell pauses deposits and withdrawals for both swETH and rswETH, stating it will resume once NAV is restored to the correct level; it says it is working with security partners including Seal911 and that no ETH has left the affected contracts.","source":"Blockonomi","source_url":"https://blockonomi.com/swell-pauses-sweth-and-rsweth-deposits-and-withdrawals-over-inflated-exchange-rates/"},{"date":"2026-10","date_original":"2026-10-24","event":"Continued reporting on the incident (KuCoin news flash, among others) describes the pause as ongoing with no confirmed cause or reopening timeline; a reported but unconfirmed link to a leaked Railway key circulates in coverage.","source":"KuCoin","source_url":"https://www.kucoin.com/news/flash/swell-network-halts-sweth-and-rsweth-withdrawals-after-leaked-railway-key-causes-unbacked-rate-hikes"}]},"v":1}