-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0262 ============================================================ Advisory-ID: 0xCERT-2026-0262 Severity: High Published: 2026-10-22T01:28:18.000Z Updated: 2026-10-22T12:44:52.784Z Chains: Ethereum, Arbitrum, Base, Other / Multi-chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0262 Title: Swell swETH and rswETH admin keys suspected compromised; malicious upgrade contracts deployed Summary - ------- A researcher reports that Swell's swETH and rswETH admin keys appear compromised, with unbacked NAV increases and four malicious upgrade contracts deployed that could take about 2,500 ETH. Swell is investigating, says no ETH has left its contracts, and says no user action is required. Details - ------- Summary On 22 October 2026 security researcher Spreek (@spreekaway) reported that the admin keys for Swell DAO's swETH and rswETH appear to be compromised. Per the report, the attacker is raising the tokens' NAV by up to 1% each hour without backing, and four malicious upgrade contracts have been deployed. These could take about 2,500 ETH but had not been queued through the multisig at the time of the report. Swell confirmed it is aware of reports of suspicious activity on the swETH and rswETH contracts and is investigating with its security partners. Affected - - Swell swETH and rswETH contracts (Ethereum); DeFiLlama also lists Arbitrum, Base and Hyperliquid L1 - - No fix available at time of publication (investigation ongoing) Impact Per the researcher, the attacker can raise swETH/rswETH NAV without backing and has staged contract upgrades that could take about 2,500 ETH if executed. Swell states that no ETH has left the swETH or rswETH withdrawal or deposit contracts. The root cause is unconfirmed. The researcher's suggested link to the Railway platform is described by the researcher as a timing correlation without conclusive evidence. No attacker addresses have been published by a primary source yet. Recommended actions - - Follow Swell's official channels (@swellnetworkio); Swell says no user action is required at this time. - - Integrators that price swETH/rswETH from on-chain NAV should review exposure to unbacked NAV changes until Swell concludes its investigation. - - Watch for pending upgrades on the swETH/rswETH proxies. Source & attribution This 0xCERT advisory summarises a report by security researcher Spreek (@spreekaway): https://x.com/spreekaway/status/2113079969295593976, and Swell's official statement: https://x.com/swellnetworkio/status/2113103884885561610. Incident listed by DeFiLlama. Details may change; refer to the original source for the authoritative record. References - ---------- - - https://x.com/spreekaway/status/2113079969295593976 - - https://x.com/swellnetworkio/status/2113103884885561610 - - https://panews.io/articles/01a1617f-6e92-777b-801b-40fa807aa3d7 - - https://defillama.com/hacks Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmraPNgJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmfBQnWkN5rZ4fAZlaNUQY+UYHGtozdKFEgtnUBC 6hoQlhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAC9uAD/cQ2qDKrxAh2NP8sZ WogD1y9Ujr8RgSLEC1nztrmV5SkA/jmgPtwfVbC0aSXDzpo2xe4sXkjyLkA0 CNgGVdsyZxMM =bKhn -----END PGP SIGNATURE-----