Swell swETH e rswETH · Breach

Swell pauses swETH and rswETH after suspected admin key compromise

Oct 21, 2026 · 1 min read

Swell has paused deposits, withdrawal requests and ETH claims for swETH and rswETH, its Ethereum liquid staking and restaking tokens, until the tokens' net asset value (NAV) is corrected. Researcher Spreek reported on 22 October that the admin keys appeared compromised, with unbacked NAV inflation and four malicious upgrade contracts able to take about 2,500 ETH; Swell has not confirmed those points and says all funds are safe. Holders should follow only official channels and avoid refund or claim links.

By HIFY Radar newsroom Updated 10/26/2026 01:17 PM Get this every day →← Back to the feed 4 sources

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Swell has paused deposits and withdrawals for swETH and rswETH, its liquid staking and restaking tokens on Ethereum. A researcher reported on 22 October that the tokens' admin keys appeared compromised and that the tokens' value was being inflated without ETH backing. Swell says no ETH has left the contracts, all funds are safe, and it is working with security partners and the volunteer emergency-response group Seal911 to correct NAV.

Why it matters

Users cannot deposit, request withdrawals or claim ETH until NAV is corrected, with no date set for reopening. The researcher estimates exposure of about 2,500 ETH via four malicious upgrade contracts; Swell has not confirmed the figure and no loss has been reported. DeFi markets that accept swETH or rswETH as collateral may reprice those assets.

What to do

Follow only Swell's official channels and do not interact with refund or claim links, which carry phishing risk. Review direct exposure to swETH and rswETH and check how lending markets price these collateral assets before moving funds.

For the technical team

Affected: Swell swETH e rswETH (tokens de liquid staking e restaking no Ethereum) · swETH (0xf951E335afb289353dc249e82926178EaC7DEd78), supply 10,050; rswETH (0xFAe103DC9cf190eD75350761e95403b8aFa6c0), supply 10,654 (on-chain reading at block 26,254,526).
Exploitation: No confirmed loss; Swell states no ETH has left the deposit or withdrawal contracts. Spreek reported NAV inflated by up to 1% per hour unbacked and four upgrade contracts able to take about 2,500 ETH if executed; this is an exposure estimate, not a reported loss. Swell has not confirmed the key compromise, the hourly increases, the four contracts or the figure.
Fix: No patch. On-chain controls have paused deposits, withdrawal requests and ETH claims for both tokens; NAV correction is a prerequisite for reopening. Swell is working with security partners and Seal911.
Vector: Suspected compromise of the admin keys for the swETH and rswETH contracts (claimed by researcher Spreek on 22 Oct, not confirmed by Swell). Admin keys allow contract upgrades; the attacker reportedly deployed four malicious upgrade contracts without multisig approval and raised NAV by up to 1% per hour without ETH backing.
More details: Timeline: 01:28 UTC 22 Oct, Spreek's post on compromised keys; 03:03 UTC, Swell says it is aware of suspicious activity and no action is required; 06:39 UTC 23 Oct, pause announced on X; The Defiant reported withdrawal requests and ETH claims blocked onchain. Rates at block 26,254,526 (09:47 UTC): swETH at 1.2030 ETH per token and rswETH at 1.1377 ETH per token. Advisory 0xCERT-2026-0262 lists start as 2026-10-22; addresses of the four malicious contracts were not disclosed in the sources.