Swell pauses swETH and rswETH deposits and withdrawals over rate anomaly

What happened

Swell announced at 2:39 a.m. ET on Friday, Oct. 23, that it had stopped deposits and withdrawals for swETH and rswETH. The team said the next step is to bring the tokens' net asset value back to the correct level before reopening the contracts. It did not provide a reopening schedule and has not issued guidance on trading or providing liquidity, according to Unchained and Blockonomi.

Later on Friday, at 4:48 p.m. ET, Unchained's read of the contracts showed swETH at roughly 1.203 ETH and rswETH at about 1.138 ETH. Those readings were about 6% and 5% higher than the last rates that on-chain analyst Spreek had identified as clean: 1.133 ETH for swETH and 1.082 ETH for rswETH. Blockonomi reported the same figures and the same comparison.

On decentralized exchanges, the tokens were changing hands below those contract rates. swETH traded near 1.089 WETH in a Uniswap pool with about $143,000 in liquidity, while rswETH traded near 1.029 WETH on Curve, according to Unchained. Swell has said that no ETH has left the swETH or rswETH deposit or withdrawal contracts and that all funds are safe. The team also warned that incidents of this kind can lead to more phishing attempts.

Why it matters

The pause matters because swETH and rswETH are tokenized staking tokens whose contract rates are meant to reflect net asset value. A gap between the rate reported by the contract and the price available on decentralized exchanges can complicate how holders, traders and lending markets value the tokens. Swell's decision to block deposits and withdrawals while it corrects the rate leaves holders unable to move through the protocol, even as secondary-market trading continues.

The size of the affected supply adds to the attention. DefiLlama data cited in the reports put swETH at about $29 million and rswETH at roughly the same amount. Swell has not offered guidance on trading or liquidity provision, leaving open how holders will value the tokens while the contracts are paused.

What the data shows

Beyond the contract rates, the reports point to several market and lending data points. Spreek's incident report, which he said was written with AI assistance and not fully checked, found that as of late Oct. 21 neither swETH nor rswETH was accepted by Aave, Spark or Fluid. A Morpho market that priced off the contract rate had about 34 ETH available to borrow.

The decentralized-exchange quotes show the market prices well below the contract readings: about 1.089 WETH for swETH on Uniswap and about 1.029 WETH for rswETH on Curve. The Uniswap pool cited by Unchained held roughly $143,000 in liquidity. DefiLlama's figures of about $29 million for each token provide a sense of the value affected by the halt.

Background

The pause followed a warning from Spreek on Wednesday, Oct. 21, at 9:28 p.m. ET. He wrote that admin keys for both tokens appeared to be compromised and that the net asset value was being raised by up to 1% each hour without backing at the time. He also said four malicious upgrade contracts capable of taking about 2,500 ETH had been deployed, but that none had been queued through Swell's multisig.

Odysseus, founder of Phylax Systems, described the incident as bot-key abuse and said the 2,513 ETH held was not a confirmed loss, according to the reports. Swell said at 11:03 p.m. ET that it was investigating with security partners and that no ETH had left the contracts. Both researchers raised a possible connection to Railway, a cloud deployment platform. Railway disclosed on Oct. 21 that an unauthorized third party may have accessed customers' encrypted environment variables and read some in decrypted form; its disclosure does not mention Swell, and Swell has not confirmed a link or described a cause.

What is still unclear

The central unresolved question is what caused the exchange rates to rise and whether the admin-key concerns are connected to the pause. Swell has not confirmed the cause, and its statements have focused on the contract balances and the plan to restore net asset value. The possible Railway link remains unconfirmed by either Swell or Railway. Spreek's report was also described by its author as AI-written and not fully checked, which limits how much weight can be placed on its lending-market findings.

What to watch

Readers should watch for Swell's next statement on the corrected net asset value and any reopening date for deposits and withdrawals. Also relevant will be whether Swell confirms or rules out a connection to Railway, and whether it issues guidance on trading or liquidity provision. The reports do not indicate when any of those updates will come.

Questions readers ask