Researchers Flag Inflated swETH and rswETH Rates After Swell Key Compromise
Security researcher Spreek reports an unidentified actor took control of Swell DAO hot keys, raising swETH and rswETH rates 1% per hour with no new ETH. Four malicious upgrades could reach about 2,513 ETH, though Swell says no ETH has moved.
Swell's liquid staking tokens are reportedly worth more on paper than the ETH behind them, because an unidentified actor appears to have seized Swell DAO's operational hot keys, including the oracle bot that sets exchange rates for swETH and rswETH, and has been pushing both rates upward with no new ETH coming in. Security researcher Spreek reported the incident on October 22, 2026.
According to Spreek's report, the actor held the keys as of 14:25 UTC on October 21 and from there allegedly began raising both tokens' exchange rates. The increases ran at the system maximum of 1% per hour. By October 22, swETH's rate had reportedly climbed about 3.0% above 1.133254 ETH, while rswETH sat roughly 2.0% above 1.082464 ETH.
What the rate does, and why inflating it matters
A liquid staking token's exchange rate is the amount of ETH one token can be redeemed for. Think of it as the price printed on a claim ticket: if someone else controls the printing press, the ticket can promise more than the vault holds. Here the oracle bot is that press, and the reported increases were not matched by incoming ETH.
Queued upgrades put 2,513 ETH at risk
The more serious exposure lies in four malicious upgrade contracts that Spreek's report says were deployed. If executed through Swell's timelock, they could sweep approximately 2,513 ETH from various contracts. The upgrades are loaded but have not fired, and the 2,513 ETH is exposed, not a confirmed loss.
The Swell team confirmed it is investigating suspicious activity. It said no ETH had been withdrawn from or deposited into the affected contracts and that the protocol remains fully operational.
Market impact so far
DEX prices have reflected only a fraction of the reported inflation, which points to a possible dislocation between the on-chain rate and market price. Third-party venues are reportedly unaffected. Swell's TVL stood at roughly $29.41 million on the day of the report, and rswETH's market cap ranged between $27 million and $58 million depending on the data source.
The 1% hourly cap limited how fast the damage could compound. If Swell governance can block or cancel the four queued upgrades before they execute, the 2,513 ETH may never be touched.
Possible Railway link, unconfirmed
Researchers flagged a potential connection to the Railway cloud platform following a disclosure from that platform, but the link is unconfirmed. AI tools also partially assisted in documenting the breach, so some details have not been independently verified.
The episode shows how much weight a liquid staking protocol places on the operational keys around its contracts. Whoever controls the oracle bot can move a token's reported value, and whoever controls the upgrade path can reach the ETH underneath it. Whether governance acts on the queued upgrades before they execute will decide if this stays an alarm or becomes a loss.
