Swell DAO admin keys have been compromised.
Security & Exploits ·
Admin keys for Swell DAO's swETH and rswETH tokens were compromised in connection with a railway-related incident, with an unknown actor controlling the operational hot keys since 14:25 UTC on 21 October. The actor manipulated exchange rates upward by the maximum allowed 1% hourly increment with no underlying ETH backing the increases, and redirected rswETH's EigenLayer rewards to a separate wallet. The attacker also deployed contracts capable of extracting approximately 2,513 ETH from Swell's withdrawal and deposit contracts, though no upgrade enabling such a drain had been queued as of 01:20 UTC on 22 October, and no external liquidity pools were drained.
The rate manipulations were precise and methodical, raising swETH by 3.0% and rswETH by 2.0% above their last known rates within minutes of each hourly reset window. The oracle bot key alone controls reserve balances for both tokens, with the proof-of-reserve check disabled and no independent verification of the inflated figures. The actor's fund movements across Ethereum, Arbitrum, Base, and other chains—including deposits to Lighter and Hyperliquid accounts—suggest the compromise extended beyond the oracle bot to the entire hot-key infrastructure, as gas was swept from 30 Swell hot keys.
Whether the compromise resulted from a key theft or internal misconduct remains unclear. Further rate increases are scheduled to occur within hours under the contract's 3,600-second repricing cycle, and arbitrage requests filed at the inflated rates await processing.