Swell's swETH and rswETH admin keys compromised; attackers inflating token values and preparing contract upgrades that could drain ~2,500 ETH.
Security & Exploits ·
Admin keys for Swell DAO's swETH and rswETH tokens appear to have been compromised, with an unknown actor gaining control of operational hot keys and the oracle bot responsible for setting token exchange rates. Since 14:25 UTC on 21 October, the attacker has been incrementally raising the net asset value of both tokens by 1% per hour—the maximum permitted by the contracts—without any corresponding ETH backing. The actor also redirected rswETH's EigenLayer protocol rewards to a separate wallet.
The compromise poses a material risk to protocol reserves. Four malicious upgrade contracts have been deployed that could extract approximately 2,513 ETH from Swell's withdrawal and deposit infrastructure should they be approved. As of 22 October 01:20 UTC, no upgrade had been queued through Swell's multisig timelock, and no third-party platforms reported drains. However, the swETH rate had climbed 3.0% above its last verified level while rswETH stood 2.0% above baseline; DEX pricing on Uniswap had only partially tracked these changes.
The rate-increase mechanism operates within constraints designed to prevent rapid manipulation: the oracle can only reprice once per hour and is capped at 1% per adjustment. What remains unresolved is whether the compromise stems from a key rotation failure, infrastructure breach, or insider action. Pausing oracle functions and rotating the entire hot-key store were among the immediate steps proposed to arrest further damage.