Researchers Flag Swell Hot Key Compromise Inflating swETH and rswETH Rates
By Crypto Wire
October 22, 2026
Security researcher Spreek reported on October 22, 2026 that an unidentified actor had taken control of Swell DAO operational hot keys — including the oracle bot that sets on-chain exchange rates for liquid staking tokens swETH and rswETH — Crypto Briefing said. Rates were allegedly pushed higher at the protocol’s maximum 1% per hour with no matching new ETH backing the climb; by Oct 22, swETH sat about 3% above its prior rate band and rswETH about 2%. Four upgrade contracts were reportedly queued that could sweep about 2,513 ETH if they clear Swell’s timelock — loaded, not yet executed. Swell said it is investigating, that no ETH had been withdrawn from or deposited into the affected contracts, and that the protocol remains operational. This is a Rug Room ops-key chapter: oracle/hot-key compromise and pending governance risk, not a confirmed drain print.
Desk cut for holders and venues: DEX prices reportedly reflected only a fraction of the on-chain rate inflation, so paper oracle rates and market marks may diverge. Any protocol that values swETH/rswETH off the on-chain exchange rate rather than market prices could see collateral look healthier than it is — Crypto Briefing notes third-party venues had not been drained as of the report. Swell TVL was cited near $29.4 million that day. Researchers flagged an unconfirmed possible link to the Railway cloud disclosure; treat that as atmosphere until Swell or Railway confirm a chain of custody — keep the Railway env-var drain LN as a separate infrastructure chapter.
Keep this file separate from NEM/PancakeSwap LP logic drains and from SEAL’s fake white-hat Solana PoC advisory — different lure surfaces (tokenomics bug vs researcher malware kit vs LST hot-key ops). Today’s beat is whether governance cancels the four queued upgrades before the ~2,513 ETH path can fire.
For security desks, the cut is control plane risk: whoever holds the oracle/hot keys can rewrite what the protocol says a staking token is worth — even when consensus contracts stay “live.”
What to watch on-chain next: Watch whether Swell cancels or executes the four queued upgrades before the timelock, whether swETH/rswETH on-chain rates re-anchor to market, and whether Swell or Railway publish a dated confirmation (or denial) of any shared infrastructure path.
Bottom line: Spreek says Swell hot keys — including the rate oracle — were compromised, inflating swETH/rswETH with about 2,513 ETH exposed via queued upgrades; no confirmed drain yet.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The cryptocurrency and NFT markets are highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
