Holders of Swell‘s swETH and rswETH cannot deposit or withdraw through the protocol after the team said at 2:39 a.m. ET Friday it had paused both tokens’ deposits and withdrawals. Swell wrote that returning their net asset value (NAV) “to the correct value” is the next step before it reopens them.
At 4:48 p.m. ET Friday, the swETH contract put its rate at about 1.203 ETH and rswETH at about 1.138 ETH, according to Unchained’s read of the contracts. Those figures sit roughly 6% and 5% above the last rates that on-chain analyst Spreek identified as clean, 1.133 ETH and 1.082 ETH.
On decentralized exchanges, swETH fetched about 1.089 WETH in a Uniswap pool with roughly $143,000 of liquidity, and rswETH went for about 1.029 WETH on Curve. According to DefiLlama, swETH holds about $29 million and rswETH holds roughly the same.
Swell has not given a reopening timeline or guidance on trading or providing liquidity. “All funds are safe,” the team wrote, and it warned that events like this can bring more phishing attempts.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
How the rates rose
At 9:28 p.m. ET on Wednesday, Oct. 21, Spreek wrote that admin keys for both tokens appeared to be compromised and that NAV was being raised by “max 1% (unbacked) each hour” at the time. He said four malicious upgrade contracts able to take about 2,500 ETH had been deployed, but none had been queued through Swell’s multisig.
Odysseus, founder of Phylax Systems, said the incident looked like “BOT-key abuse” and stressed that the 2,513 ETH held “is NOT confirmed loss.”
Swell said at 11:03 p.m. ET that it was investigating with security partners and that “no ETH has left the swETH or rswETH withdrawal or deposit contracts.”
Cause still unconfirmed
Both researchers raised a possible tie to Railway, a cloud deployment platform. Railway said in an Oct. 21 security disclosure that an “unauthorized third party” may have gotten into customers’ encrypted environment variables and read some of them in decrypted form. Railway’s disclosures do not mention Swell, and Swell has not confirmed a link or described the cause.
Spreek’s incident report, which he said was AI-written and not fully checked, found that as of late Oct. 21 none of Aave, Spark or Fluid accepted either token and that a Morpho market priced off the contract rate had about 34 ETH available to borrow.
In April, LayerZero linked a $292 million exploit of the bridge for Kelp DAO’s rsETH restaking token to North Korea’s Lazarus Group, and Kelp DAO later sued LayerZero over it.
Related Listen: How Spark Escaped the KelpDAO Hack Before It Even Happened
The post Swell Freezes swETH and rswETH Withdrawals Until It Corrects Their Exchange Rates appeared first on Unchained.