Swell Network pauses liquid staking after hot-key compromise

Swell Network has paused deposits and withdrawals for its liquid staking tokens, swETH and rswETH, following a security breach involving the compromise of the Swell DAO’s operational hot keys.

Security researchers reported that an unidentified actor gained control of the protocol’s keys, including the oracle bot responsible for setting exchange rates. Following the compromise, the actor allegedly began raising the exchange rates of swETH and rswETH by the system’s maximum allowed rate of 1% per hour without any corresponding ETH deposits to back the increased value.

Additionally, four malicious upgrade contracts were deployed that could potentially sweep approximately 2,513 ETH from various protocol contracts. While these upgrades were staged, they had not yet been queued through the multisig. Swell has confirmed it is investigating the activity and is working with security partners, including Seal911, to secure the infrastructure and restore the net asset value to correct levels. The protocol remains operational, and the team stated that no ETH had been withdrawn from or deposited into the affected contracts at the time of the investigation.