Ethereum liquid staking protocol Swell has suspended deposits and withdrawals for its swETH and rswETH tokens after their smart contracts began reporting exchange rates significantly above previously established levels.The suspension, announced on October 23, 2026, followed warnings from blockchain security researchers about potentially compromised administrative credentials and unexplained increases in the tokens’ reported net asset values.Swell said it was working with security partners and Seal911, the Security Alliance’s emergency response initiative, to secure its infrastructure and restore accurate valuations. The protocol maintained that user funds were safe and that no ETH had left the affected deposit or withdrawal contracts.However, Swell has not confirmed the underlying cause of the irregularities or provided a timetable for restoring normal operations.The incident has temporarily restricted direct redemptions for two Ethereum staking products, creating uncertainty for holders seeking to convert their tokens back into underlying ETH.
Contract Exchange Rates Diverge From Market Prices
On October 23, the swETH contract reported an exchange rate of approximately 1.203 ETH per token, while rswETH showed approximately 1.138 ETH. Those figures were around 6% and 5% above the last reliable rates identified by on-chain investigator Spreek, who recorded approximately 1.133 ETH for swETH and 1.082 ETH for rswETH.The discrepancy was particularly significant because decentralized exchange prices remained substantially lower than the contract-reported valuations. According to Unchained, swETH traded near 1.089 wrapped ETH (WETH) on Uniswap, while rswETH traded around 1.029 WETH on Curve.The reported Uniswap liquidity pool contained approximately $143,000, illustrating the limited liquidity available in at least one secondary trading venue. Data cited from DefiLlama indicated that each staking product held approximately $29 million in underlying value at the time.Unlike conventional ETH holdings, liquid staking tokens represent claims on staked assets and accrued rewards. Their exchange rates generally increase as staking rewards accumulate, rather than rising sharply without corresponding changes in backing assets.Consequently, unexpectedly elevated contract rates can create accounting discrepancies and potentially affect lending markets that rely on those valuations. Swell’s suspension blocks new deposits, withdrawal requests and claims for ETH through the affected contracts until the accounting problem is resolved.
Researchers Investigate Possible Administrative Key Compromise
Security concerns emerged on October 21 when Spreek reported that administrative credentials associated with both tokens appeared to have been compromised. The researcher alleged that the tokens’ net asset values were being increased by as much as 1% per hour without corresponding asset backing.Spreek also identified four suspicious upgrade contracts that could potentially affect approximately 2,500 ETH. However, the researcher reported that the upgrades had not been queued through Swell’s multisignature authorization process.Odysseus, founder of blockchain security firm Phylax Systems, characterized the suspected incident as possible automated bot-key abuse. He emphasized that approximately 2,513 ETH identified in the affected infrastructure did not represent a confirmed loss.Swell acknowledged the suspicious activity on October 22, stating that no ETH had been transferred out of the relevant deposit or withdrawal contracts. The following day, it implemented the broader suspension while continuing its investigation.Researchers also discussed a possible connection to an unrelated security disclosure by cloud deployment provider Railway concerning access to encrypted environment variables. However, neither Railway nor Swell has confirmed any connection between the incidents.The distinction matters because suspected credential exposure does not independently establish that funds were stolen or that a particular infrastructure provider caused the problem. Swell has advised users to rely on official communications and remain alert to phishing attempts during the disruption.For holders, the immediate concern is the inability to redeem tokens directly through the protocol, even though secondary-market trading may remain possible. Restoring accurate exchange rates and demonstrating that administrative controls are secure will be essential before normal deposit and withdrawal operations can resume.