Swell’s liquid staking tokens are reportedly worth more on paper than they should be. Someone may have nudged the numbers on purpose.
Security researcher Spreek reported on October 22, 2026 that an unidentified actor had reportedly taken control of Swell DAO’s operational hot keys, including the oracle bot that sets exchange rates for swETH and rswETH. The reported 2,513 ETH sitting in Swell contracts is exposed, but it is not a confirmed loss.
What researchers say happened
According to Spreek’s report, the actor had control of the keys as of 14:25 UTC on October 21. From there, the actor allegedly began raising the exchange rates of both tokens.
The increases ran at the maximum the system allows: 1% per hour. Crucially, no new ETH came in to back those higher rates.
By October 22, swETH’s rate had reportedly climbed about 3.0% above 1.133254 ETH. The rswETH rate sat roughly 2.0% above 1.082464 ETH.
Spreek’s report also says four malicious upgrade contracts were deployed. If those upgrades were executed through Swell’s timelock, they could sweep approximately 2,513 ETH from various contracts. The upgrades are loaded, but they have not fired.
Swell’s response and the open questions
The Swell team confirmed it is investigating the suspicious activity. It said no ETH had been withdrawn from or deposited into the affected contracts, and that the protocol remains fully operational.
There is a reported but unconfirmed potential link to the Railway cloud platform, which researchers flagged following a disclosure from that platform. AI tools also partially assisted in documenting the breach, according to the research findings, meaning certain details in the public account have not been independently confirmed.
Why an oracle bot matters
An oracle bot is the piece of automation that reports the token exchange rate on-chain. Whoever controls it effectively controls what the protocol says one token is worth. Hot keys are the private keys kept online so bots can sign routine transactions.
The 1% hourly cap limited how fast the damage could compound, but did not stop the rate from rising.
Markets are not buying the new rates
Decentralized exchange prices have reflected only a fraction of the reported inflation, suggesting possible market dislocations between the on-chain rate and where the tokens actually trade.
Swell’s total value locked stood at approximately $29.41 million on the day of the report. The market cap for rswETH ranged between $27 million and $58 million, depending on the data source. Third-party venues remain unaffected, and no draining of outside platforms has occurred.
What this means for holders and DeFi
For swETH and rswETH holders, the immediate question is the timelock. If Swell’s governance can block or cancel the four queued upgrades before they execute, the approximately 2,513 ETH may never be touched.
Any venue that values these tokens using the on-chain exchange rate, rather than market prices, could theoretically be exposed to collateral that looks healthier than it is. The research notes that outside platforms have not been drained.
If the Railway connection is confirmed, it would point to infrastructure outside the smart contracts themselves as the weak link — a reminder that a protocol’s security extends to every service its bots run on.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.