SECURITY ALERT

The ETH is still there, Swell says.

The price tag on it is what needs fixing.

Swell has paused deposits and withdrawals for swETH and rswETH, its liquid staking and restaking tokens on Ethereum, it said on X at 06:39 UTC on Friday, a day after a researcher reported that someone appeared to be pushing up the tokens’ value without ETH behind it.

Swell says it is working with its security partners and Seal911, a volunteer emergency-response group, “to fully secure our infrastructure”.

The next step, it said, is to return NAV, the net asset value each token claims in ETH, “to the correct value”. Only then will deposits and withdrawals reopen.

“All funds are safe,” Swell wrote. It has not said what went wrong or when the pause will end.

So what moved the number?

The timeline

At 01:28 UTC on 22 Oct, security researcher Spreek posted that the admin keys for swETH and rswETH appeared to be compromised.

Spreek said an attacker was raising the tokens’ NAV by up to 1% an hour, unbacked, and had deployed four malicious upgrade contracts that could take about 2,500 ETH if executed. Those upgrades had not been queued through the multisig, the wallet that needs several signers, Spreek said.

At 03:03 UTC, Swell said it was “aware of reports of suspicious activity”, that no ETH had left the deposit or withdrawal contracts, and that no action was required.

At 06:39 UTC on 23 Oct, it paused both tokens. The Defiant reported that withdrawal requests and ETH claims are now blocked onchain.

Has anything actually left?

What is confirmed, and what is not

Confirmed by Swell: the pause, the work with Seal911, and that NAV is currently wrong.

Not confirmed by Swell: that its keys were compromised, the hourly increases, the four contracts, or the roughly 2,500 ETH. That figure is an exposure estimate, not a reported loss.

Swell has not said how far NAV moved, which way it will be corrected, or whether holders will see a change in what each token is worth.

At block 26,254,526 (09:47 UTC on Friday), the contracts reported these rates, by our reading of on-chain data:

swETH 0xf951E335afb289353dc249e82926178EaC7DEd78: 1.2030 ETH per token, supply 10,050

rswETH 0xFAe103DC9cf190eD75350761e95403b7b8aFa6c0: 1.1377 ETH per token, supply 10,654

Those are the figures Swell says it needs to correct. We could not compare them with readings from before 22 Oct.

Which number will holders be paid out on?

What to do

  • Do not interact with links promising refunds or claims. Swell warned that incidents like this bring phishing, and said to follow only its official channels.
  • If you lend or borrow against swETH or rswETH, check how your market prices them. A reported rate that later moves can change collateral values; see how DeFi lending markets use collateral.
  • Admin keys can upgrade contracts. For why that matters, see what a private key controls.

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.