Unbacked rate hikes hit Swell's swETH and rswETH after Railway's key-leak disclosure
Key Takeaways
- •An unauthorized actor using Swell's oracle BOT hot keys pushed the exchange rates of swETH and rswETH higher at the 1% hourly cap, with three swETH and two rswETH hikes recorded and no new ETH backing the increases.
- •Swell paused deposits and withdrawals for swETH and rswETH on October23, stating the functions would resume only once the exchange rate returns to its correct value.
- •Four malicious upgrade contracts were deployed that could capture around 2,500 ETH if executed, though none had been triggered and the roughly 2,513 ETH Swell was holding is not a confirmed loss.
- •The incident followed Railway's October 21 disclosure that an intruder may have accessed customer-stored secrets, with an attacker later draining about $371,000 from wallets across at least 19 EVM chains using keys stored on the platform, but no confirmed link to Swell exists.
- •Inflated on-chain rates could overstate collateral values in lending markets that price these tokens off the oracle rate, while Swell's liquid staking and restaking products each held around $29 million in total value locked.
Security researcher Spreek reported on October 22 that an actor holding Swell DAO's operational hot keys had pushed up the exchange rates of its swETH and rswETH liquid staking tokens at the 1% hourly cap, with no new ETH backing the increases.
Exchange rates for liquid staking tokens normally rise only as staking rewards accrue, so an increase with no new ETH behind it pushes the reported rate above what the protocol's holdings support. The findings surfaced hours after cloud platform Railway disclosed that an intruder may have gained access to secrets stored by customers.
Five rate hikes of roughly 1% recorded across both tokens
Spreek shared the findings on X at 01:28 UTC, writing that the admin keys for both tokens "appear to be compromised (railway related?)". According to the post, attackers were "raising NAV by max 1% (unbacked) each hour."
Phylax Systems founder Odysseus described the activity as "BOT-key abuse," counting three swETH and two rswETH rate hikes of roughly 1% each. Swell's published oracle code restricts submission of repricing snapshots to the BOT role alone. That bot operates on hot keys, which remain online and sign transactions without human involvement — an arrangement that places the accuracy of the on-chain rate in the hands of a single set of always-online credentials. Rate caps of this kind limit how far an oracle can move the price in one update; here they defined the pace of the unauthorized increases.
Ethereum records show a single address submitting swETH snapshots at 23:02 UTC on October 21, followed by further submissions at 00:04 and 01:08 UTC on October 22. Reported figures as of October 22 place swETH around 3.0% above 1.133254 ETH, while rswETH was up about 2.0% from 1.082464 ETH.
Railway [said on October 21]( that it had observed anomalous activity in systems that store customer environment variables — a standard place for applications to keep runtime credentials — and that an outside party may have accessed decrypted contents for some of them. The stored secrets include API keys and registry credentials. The platform froze all deployments and urged users to rotate stored secrets.
The same day, crypto investigator Tay said an attacker had drained roughly $371,000 from wallets across at least 19 EVM chains using keys stored on Railway. No connection between the Railway breach and the Swell incident has been confirmed.
Four malicious upgrade contracts could take about 2,500 ETH
Swell said on X at 03:03 UTC on October 22 that it was aware of reports of "suspicious activity on the swETH and rswETH contracts" and was investigating alongside its security partners. "No ETH has left the swETH or rswETH withdrawal or deposit contracts," the team wrote, adding that no action was required from users.
On October 23, Swell paused deposits and withdrawals for swETH and rswETH, saying the functions would resume once NAV returns to the correct value. The exchange rate governs how much ETH each token converts to on deposit and withdrawal, which is why reopening those functions hinges on the corrected figure.
Spreek also reported that four malicious upgrade contracts had been deployed, capable of taking around 2,500 ETH if executed. Odysseus estimated that Swell was holding 2,513 ETH, while noting the amount "is NOT confirmed loss." None of the upgrades had been executed at the time of the reports, leaving their status, the NAV correction, and any confirmed link to the Railway incident as the key items to watch.
Some details in the research were reportedly compiled with AI assistance and remain unverified.
Inflated rates carry contagion risk for lending markets
Only a fraction of the elevated rates is reportedly reflected in DEX prices. Swell's liquid staking and liquid restaking products each held around $29 million in total value locked on October 23, while data sources indicate a market capitalization for rswETH between $27 million and $58 million.
In a lending market that prices swETH or rswETH off the on-chain rate, the inflated figure would count as collateral. Cryptopolitan previously tracked a similar contagion path when KelpDAO's rsETH exploit spread to Layer 2 lending markets. Leaked keys were also behind the Fearless Wallet extension incident, in which the private keys of Polkadot users were sent to an attacker's server.
