Key Highlights:
- Swell paused deposits and withdrawals for its liquid staking and restaking tokens, swETH and rswETH, following reports of suspicious activity and artificially inflated exchange rates.
- Security researcher Spreek warned that admin keys appeared compromised with four malicious upgrade contracts deployed, creating a potential risk to approximately 2,500 ETH ($5.9 million), though the contracts were not queued through the protocol multisig.
- Swell verified that no ETH has left the protocol’s contracts, confirming funds are safe as the team coordinates mitigation efforts alongside security collective Seal911.
Liquid staking protocol Swell has implemented emergency circuit breakers to halt deposits and withdrawals for its flagship tokens, swETH and rswETH, following anomalies identified in their underlying exchange rates. The protocol acted to block redemptions before any miscalculated rates could be exploited by external parties. Confirming the incident publicly, Swell stated via X:
We are aware of reports of suspicious activity on the swETH and rswETH contracts. Our team is investigating now with our security partners and taking all necessary precautions. No $ETH has left the swETH or rswETH withdrawal or deposit contracts. No action is required.
Advertisement
The Mechanics of the Rate Distortion
Both swETH and rswETH serve as liquid token receipts for deposited Ether, with exchange rate algorithms setting how much ETH users receive when depositing or withdrawing capital. Under normal operating conditions, these rates mirror staking and restaking accruals. However, an accounting distortion pushed swETH and rswETH contract rates to 1.203 and 1.138 respectively—elevating them roughly 6.2% and 5.2% above their last verified clean net asset values (NAV).
Had these inflated exchange rates been processed, redeeming holders could have extracted far more ETH than their tokens represented. Independent on-chain security researcher Spreek flagged the incident, calculating that the four malicious upgrade contracts could have drained roughly 2,500 ETH, valued at nearly $5.9 million with Ethereum trading near $2,360 per CoinGecko. Spreek noted on X that admin keys for the Swell DAO tokens appeared to be compromised, but highlighted that the contracts were not queued yet through the multisig governance system, preventing the unauthorized transaction execution.
Secondary Market Discounts and Protocol Response
While the protocol moved quickly to freeze its contract withdrawal gates, decentralized finance (DeFi) secondary markets priced in immediate liquidity discounts. On Uniswap, swETH slipped to approximately 1.089 WETH within a pool holding about $143,000 in liquidity. Meanwhile, rswETH dropped to around 1.029 WETH on Curve. Relative to contract-level rates, these trades represented steep discounts of roughly 9.5% for swETH and 9.6% for rswETH.
Normally, arbitrage traders capture spreads between primary redemption queues and secondary pools to restore parity within minutes. Because Swell’s withdrawal channels remain paused, arbitrage remains locked, turning the trading discount into a real-time measure of market sentiment regarding the speed and success of the accounting recovery. Swell continues to coordinate remediation alongside security response collective Seal911, reiterating in subsequent updates that All funds are safe
and emphasizing that no assets have moved out of the affected contracts.
Why This Matters
The swift containment highlights a pivotal shift in DeFi incident management: pre-emptive contract halts preventing outright drains. Earlier bridge and protocol failures—such as the incident affecting Kelp DAO’s rsETH via LayerZero that led to litigation over a $292 million loss—demonstrated the catastrophic downside when malicious drains run their course. By intervening before unverified upgrade contracts could pass governance multisig queues or process withdrawals, Swell positioned the incident as a prevented exploit rather than a finalized heist.
Nevertheless, the situation underscores systemic liquidity risk inherent to liquid staking and restaking derivatives. These tokens derive their real-world utility from seamless composability and reliable redemption pathways; when withdrawals pause, liquidity on secondary markets discounts sharply. Before Swell can normalize operations, developers must recalculate and re-anchor clean NAV metrics across both tokens, remove unauthorized contracts, and safely reactivate the redemption queues.
Frequently Asked Questions
Were any user funds stolen from Swell?
No. According to updates from Swell and on-chain monitors, no ETH has left either the swETH or rswETH deposit or withdrawal contracts. The issue was intercepted before malicious upgrade contracts could be activated via multisig governance, categorizing the event as an accounting defense and prevented exploit.
Why are swETH and rswETH trading at a discount on Curve and Uniswap?
Because official withdrawals from Swell are temporarily paused, arbitrageurs cannot redeem swETH or rswETH directly through the protocol at fair net asset value. As a result, the open market trades these tokens at a 9.5% to 9.6% discount to account for temporary illiquidity and the risk lingering until normal redemption flows resume.
What steps must occur before Swell reopens withdrawals?
Swell must finalize its security review with Seal911, correct the inflated contract net asset values back to clean balances, ensure DAO administrative security, and verify system integrity before lifting deposit and withdrawal pauses.
