News linked to both this project and an event.
Odaily reports: At 2:39 AM EST on October 23, Swell announced the suspension of deposits and withdrawals for its liquid staking token swETH and restaking token rswETH until the net asset value (NAV) returns to correct levels, without disclosing a restoration timeline. On-chain data shows that at 16:48 that day, the contracts reported approximately 1.203 ETH per swETH and approximately 1.138 ETH per rswETH, roughly 6% and 5% higher than the normal exchange rates of 1.133 ETH and 1.082 ETH as determined by Spreek, respectively; rates on decentralized exchanges stood at approximately 1.089 WETH per swETH and 1.029 WETH per rswETH, both far below the contract-reported values. Spreek stated that at 21:28 on October 21, the admin keys of both tokens were suspected to have been compromised, with NAV being inflated by up to 1% per hour without asset backing; the attacker deployed 4 malicious upgrade contracts capable of withdrawing approximately 2,513 ETH, but the transactions were not queued through Swell's multisig. Odysseus, founder of Phylax Systems, said the incident involved BOT key misuse, and losses have not been confirmed. Railway disclosed the same day that an unauthorized third party may have read customers' encrypted environment variables. Swell stated that funds are safe.
According to security researcher Spreek (@spreekaway), the administrative keys for swETH and rswETH under Swell DAO appear to have been compromised. Attackers are inflating the NAV (Net Asset Value) without asset backing by up to 1% per hour. Four malicious upgrade contracts have been deployed and are queued for multisig execution; if executed, they could result in the theft of approximately 2,500 ETH. Furthermore, analysis by ADL (@ADLXBT) indicates that the management keys control proxy administrator permissions. Once seized by attackers, these keys could allow the redirection of swETH/rswETH proxies to malicious implementation contracts, triggering minting or withdrawal functions to artificially inflate the NAV without corresponding asset backing. Spreek noted that any connection between this incident and the Railway platform remains speculative, with only a coincidental timeline observed and no concrete evidence available. The incident report he published was generated by Claude, and certain portions remain unverified.
According to official sources, Summer.fi released a post-mortem stating that on July 6, the attacker manipulated the share prices of two Lazy Summer USDC vaults by injecting overvalued Silo tokens into an offline Ark still included in the NAV, and extracted approximately $6.04 million in a single atomic transaction.