Security researcher Spreek reports that an unidentified actor reportedly took control of Swell DAO's hot keys and raised the swETH and rswETH exchange rates without new ETH backing. Four upgrade contracts could reach about 2,513 ETH if executed, but no loss is confirmed and Swell says the protocol remains fully operational.
Security researcher Spreek reported on October 22, 2026 that an unidentified actor had reportedly taken control of Swell DAO's operational hot keys, including the oracle bot that sets exchange rates for swETH and rswETH. The reported 2,513 ETH in Swell contracts is exposed, but it is not a confirmed loss.
Exchange rates climbed with no new ETH behind them
According to Spreek's report, the actor held the keys as of 14:25 UTC on October 21 and allegedly began raising the exchange rates of both tokens. The increases ran at the system's maximum of 1% per hour, and no new ETH came in to back them.
By October 22, the swETH rate had reportedly climbed about 3.0% above 1.133254 ETH. The rswETH rate sat roughly 2.0% above 1.082464 ETH.
Four queued upgrades and Swell's response
Spreek's report also says four malicious upgrade contracts were deployed. If executed through Swell's timelock, they could sweep approximately 2,513 ETH from various contracts. The upgrades are loaded but have not fired.
The Swell team confirmed it is investigating. It said no ETH had been withdrawn from or deposited into the affected contracts, and that the protocol remains fully operational.
However, a reported but unconfirmed link to the Railway cloud platform has surfaced, which researchers flagged after a disclosure from that platform. According to the research findings, AI tools also partially assisted in documenting the breach, so certain details in the public account have not been independently confirmed.
Decentralized exchange prices reflect only a fraction of the new rates
An oracle bot reports the token exchange rate on-chain, so whoever controls it effectively controls what the protocol says one token is worth. Decentralized exchange prices have reflected only a fraction of the reported inflation, which suggests possible market dislocations between the on-chain rate and where the tokens trade.
Swell's total value locked stood at approximately $29.41 million on the day of the report. Third-party venues remain unaffected, and no outside platform has been drained.
For swETH and rswETH holders, the immediate question is the timelock. If Swell's governance can block or cancel the four queued upgrades before they execute, the approximately 2,513 ETH may never be touched.
Source: Crypto Briefing
Trading involves risk.
Risk Disclaimer
