Swell, the Ethereum liquid staking protocol, has paused deposits and withdrawals for its swETH and rswETH tokens after the contracts began reporting exchange rates well above normal levels. The halt was announced early Friday, October 23, and both functions remain closed while the team works to correct the rates.

Liquid staking lets users stake ETH while holding a tradable token in return, and swETH and rswETH are Swell's liquid staking and liquid restaking tokens, respectively. Each carries an exchange rate that rises as staking rewards accrue, and that rate determines how much ETH moves in or out of the contracts when users deposit or withdraw.

The swETH contract's reported rate climbed to roughly 6% above its last clean reading, while rswETH sat about 5% above normal. Swell said no ETH has left the affected contracts, but it has not confirmed a cause or said when deposits and withdrawals will resume.

Exchange Rates Rise Above Normal Levels

Swell announced the pause at 2:39 a.m. ET on Friday and said its next step is returning the net asset value (NAV) of both tokens to the correct level. Deposits and withdrawals stay closed until then. Rates for tokens of this kind ordinarily rise only slowly as staking rewards accrue, which is why readings sitting several percentage points above their last clean values stood out.

At 4:48 p.m. ET, a reading of the contracts by Unchained showed swETH at about 1.203 ETH and rswETH near 1.138 ETH. On-chain analyst Spreek had identified the last clean rates as 1.133 ETH and 1.082 ETH, respectively.

On decentralized exchanges, swETH traded near 1.089 WETH in a Uniswap pool with about $143,000 in liquidity, while rswETH changed hands near 1.029 WETH on Curve. Both market prices sit below the rates the contracts report.

According to DefiLlama, swETH holds about $29 million in total value, and the rswETH token holds roughly the same amount. Because both tokens also trade and circulate on external markets, exposure extends beyond the protocol's own contracts. Swell has so far not offered guidance on trading or providing liquidity for either asset.

Admin Key Compromise Suspected, Cause Unconfirmed

Spreek posted on Wednesday, October 21, that the admin keys for both tokens appeared to have been compromised. Admin keys govern who can upgrade a protocol's smart contracts, while a multisig requires approval from several authorized signers before any transaction goes through. He wrote that NAV was rising by “max 1% (unbacked) each hour” at the time. He also identified four malicious upgrade contracts capable of taking about 2,500 ETH, though none had been queued through Swell's multisig.

Odysseus, founder of Phylax Systems, described the incident as “BOT-key abuse” and added that the 2,513 ETH held “is NOT confirmed loss.” His comments came shortly after Spreek's initial warning.

Swell responded at 11:03 p.m. ET that it was working with security partners. The team stated that “no ETH has left” the swETH or rswETH withdrawal or deposit contracts, and it later wrote, “All funds are safe.” It also warned that events of this kind tend to bring more phishing attempts.

Possible Connection to Railway

Both researchers raised a possible link to Railway, a cloud deployment platform developers use to build and host applications. Railway said in an October 21 disclosure that an “unauthorized third party” may have read some of its encrypted environment variables — a common place for platforms to store sensitive credentials such as API keys. The disclosure does not mention Swell, and Swell has not confirmed any connection between the two events.

Spreek's report, which he said was AI-written and not fully checked, found that Aave, Spark, and Fluid accepted neither token. A Morpho market had about 34 ETH available to borrow.

As of the latest updates, both deposit and withdrawal functions remain paused, and Swell has not provided a timeline for restoring normal operations. The open questions are the ones raised since Spreek's first warning: whether the suspected admin key compromise is confirmed, whether the four flagged upgrade contracts ever reach Swell's multisig, and whether the reported rates can be corrected to their last clean readings — 1.133 ETH for swETH and 1.082 ETH for rswETH — before and withdrawals reopen.