Swell reopens swETH, rswETH withdrawals at reset rates after Oct 22 operational-key compromise

Swell Network reopened withdrawals for swETH and rswETH on November 1, 2026, after resetting both tokens' contract exchange rates to the levels implied by the real ETH backing. The pause had been in place since October 23, when the team halted deposits and withdrawals after on-chain analysts spotted both tokens' rates climbing by the contracts' hard-coded 1 %/hour cap with no new ETH entering the system. The primary announcements are on Swell's X account (lift notice, postmortem); the pause lift was first reported by The Defiant and confirmed in a KuCoin news flash that quotes the contract addresses and the before/after exchange rates.

What happened

An attacker gained use of an operational hot key on Swell's rate-publishing path on October 21–22, per Swell's own postmortem and a corroborating note from independent researcher Spreek. The attacker then submitted false balance reports that pushed the two tokens' on-chain exchange rates upward at the 1 % per hour maximum allowed by the contract — the explicit purpose of the cap being to make exactly this kind of silent inflation visible. No ETH was moved out of either the swETH or the rswETH withdrawal or deposit contract.

The resulting inflated rates:

• swETH: 1.20297 ETH per token (vs. correct ~1.1334), ~6 % above backing.
• rswETH: 1.13768 ETH per token (vs. correct ~1.0828), ~5 % above backing.

Secondary markets priced in the discount almost immediately: swETH changed hands near 1.089 WETH on Uniswap against a thinly-funded pool, and rswETH near 1.029 WETH on Curve.

Mechanism — a rate oracle, not a balance oracle

Both tokens are rebase-free liquid staking tokens. The user's claim on ETH is denominated as "rate × token balance." Historically, the rate is updated by a privileged key as validator rewards accrue. There is no on-chain check that the rate corresponds to real ETH backing — the design assumes the key is honest. The 1 %/hour cap is a backstop, not an authentication mechanism; it limits damage, not probability.

The post-event control changes Swell has disclosed, inferable from the lift notice:

• New rate publication key, rotated after the compromise.
• Access-control contract separation — swETH access control at 0x625087d72c762254a72CB22cC2ECa40da6b95EAC, rswETH access control at 0x796592b2092F7E150C48643dA19Dd2F28be3333F.
• Withdrawal path reopens with the old withdrawal queue honored at the correct (lower) rate; no withdrawal was ever paid at the inflated rate.

The core staking and restaking contracts remain:

• swETH: 0xf951E335afb289353dc249e82926178EaC7DEd78
• rswETH: 0xFAe103DC9cf190eD75350761e95403b7b8aFa6c0

Numbers block

- Pause start                     : 2026-10-23 (06:39 UTC)
- Pause lift                      : 2026-11-01
- swETH rate inflated to          : 1.20297 ETH per swETH
- swETH rate after reset          : ~1.1334 ETH per swETH (-5.8%)
- rswETH rate inflated to         : 1.13768 ETH per rswETH
- rswETH rate after reset         : ~1.0828 ETH per rswETH (-4.8%)
- Rate inflation hard cap         : 1 % per hour
- ETH confirmed moved out         : 0
- Depositor shortfall             : ~0.25 ETH total across 20 addresses
- Compensation timeline           : within one week
- ETH deposits status             : still paused on both tokens

Impact

For holders who never deposited at the inflated rate: no loss. The reset simply restates what the contract would have shown had the attacker never pushed the key. ETH collateral is intact; the withdrawal queue clears at the correct rate.

For holders who deposited into swETH or rswETH during the inflated window: 20 addresses in total, with a combined shortfall of approximately 0.25 ETH. Swell has committed to compensation within one week; the asset of payment and the claim mechanism have not been named.

For leveraged positions: the lower rswETH rate pushes loans in the Morpho msETH/rswETH market closer to liquidation. Swell flagged this explicitly in an intermediate warning on X. The market curator is Metronome. Borrowers using rswETH as collateral should check their health factor against the new rate.

For deposits: direct ETH deposits remain paused on both tokens per The Defiant and the KuCoin flash, even though Swell's X post says "deposits and withdrawals are open." The direct-deposit control is a separate gate from the withdrawal queue.

Action checklist

1. Holders: verify your effective rate in the Swell app against the two addresses above; the correct rates as of today are approximately 1.1334 (swETH) and 1.0828 (rswETH).
2. Depositors from the Oct 21–23 window: expect contact from Swell's team with compensation terms; the shortfall universe is small (20 addresses).
3. rswETH borrowers on Morpho (msETH/rswETH): recheck collateralization at the new rate; Metronome, the market curator, has not published a backstop or liquidation grace plan.
4. Integrators: wait on the ETH-deposit gate to lift before resuming automated deposit flows; the Swell X note is ahead of the actual contract state.

Context — key-compromise LST incidents in 2026

This is the second liquid-staking protocol operational-key compromise disclosed this quarter, and the first where the attacker's lever was the rate oracle rather than a withdrawal path. The 1 % hourly cap served its stated purpose — on-chain analysts flagged the drift inside hours — and no user ETH was taken. The event will fairly be read as a validation of the cap and a warning that LST contracts whose rate feed is a single key remain a soft target. Compensation of 0.25 ETH across 20 addresses is small; the operational lesson is not.