Swell swETH and rswETH admin keys suspected compromised; malicious upgrade contracts deployed

Summary

On 22 October 2026 security researcher Spreek (@spreekaway) reported that the admin keys for Swell DAO's swETH and rswETH appear to be compromised. Per the report, the attacker is raising the tokens' NAV by up to 1% each hour without backing, and four malicious upgrade contracts have been deployed. These could take about 2,500 ETH but had not been queued through the multisig at the time of the report. Swell confirmed it is aware of reports of suspicious activity on the swETH and rswETH contracts and is investigating with its security partners.

Affected

• Swell swETH and rswETH contracts (Ethereum); DeFiLlama also lists Arbitrum, Base and Hyperliquid L1
• No fix available at time of publication (investigation ongoing)

Impact

Per the researcher, the attacker can raise swETH/rswETH NAV without backing and has staged contract upgrades that could take about 2,500 ETH if executed. Swell states that no ETH has left the swETH or rswETH withdrawal or deposit contracts. The root cause is unconfirmed. The researcher's suggested link to the Railway platform is described by the researcher as a timing correlation without conclusive evidence. No attacker addresses have been published by a primary source yet.

Recommended actions

• Follow Swell's official channels (@swellnetworkio); Swell says no user action is required at this time.
• Integrators that price swETH/rswETH from on-chain NAV should review exposure to unbacked NAV changes until Swell concludes its investigation.
• Watch for pending upgrades on the swETH/rswETH proxies.

Source & attribution

This 0xCERT advisory summarises a report by security researcher Spreek (@spreekaway): https://x.com/spreekaway/status/2113079969295593976, and Swell's official statement: https://x.com/swellnetworkio/status/2113103884885561610. Incident listed by DeFiLlama. Details may change; refer to the original source for the authoritative record.