Swell has paused deposits and withdrawals for its swETH and rswETH tokens while it works to correct the exchange rates used to account for their underlying Ether.
The liquid-staking protocol announced the pause on October 23 and said it was working with security partners and Seal911. Its stated condition for reopening is restoring the tokens’ net asset values to the correct level. The announcement supplied no reopening date.
Swell said funds were safe. That is the protocol’s assessment, rather than an independently completed audit. Security researchers have separately raised concerns about possible misuse of operational keys and increases in the tokens’ accounting rates.
A redemption rate is different from a trading price
Liquid-staking tokens represent claims associated with staked Ether. Their accounting exchange rates are meant to relate the token supply to the assets supporting it. A holder seeking to redeem relies on that relationship rather than on the token’s name alone.
If a reported rate rises without additional backing, the accounting claim can exceed what the assets justify. Correcting the figure can therefore be necessary before processing further deposits and redemptions fairly.
Secondary-market trading is a separate route. A token can continue changing hands in a liquidity pool even when its issuer’s redemption process is unavailable. A pool’s quoted price also depends on its own liquidity and the size of the transaction.
These distinctions make a paused receipt token different from immediately accessible ETH. A balance can remain visible in a wallet while the normal route for exchanging it for the underlying asset is interrupted.
Researchers’ claims require careful boundaries
Researcher Spreek reported apparent compromise of the tokens’ administrative keys and unbacked increases in their net asset values. Swell’s earlier statement said no ETH had left its withdrawal or deposit contracts.
The researchers’ discussion of roughly 2,500 ETH described potential exposure through proposed malicious upgrades, not a confirmed theft of that amount. Parts of the circulated incident analysis were AI-assisted and explicitly not fully verified by its author.
We therefore are not treating those technical estimates as a completed forensic account. The confirmed operational consequence in Swell’s announcement is the pause while accounting values are corrected.
A Railway connection remains unconfirmed
The incident follows Railway’s disclosure that customer credentials may have been exposed. Security researchers have suggested a possible connection, but the timing of two incidents does not establish how Swell’s keys were accessed.
Neither Swell’s cited announcement nor Railway’s preliminary report establishes that Railway caused this incident. Reporting the proposed connection as a proven breach route would go beyond the available evidence.
The next material developments will be an explanation of the cause, confirmation that the accounting correction is complete and a clear reopening notice. Until then, holders face an interrupted redemption process, with the protocol also warning that incident-related phishing attempts may follow.