Original source text
Table of contentsSwell paused deposits and withdrawals for its liquid staking token swETH and its liquid restaking token rswETH on Friday, October 23, after both contracts began quoting exchange rates that no longer matched the ETH they actually hold. The swETH contract was reporting roughly 1.203 ETH per token, about 6% above the last clean reading of 1.133, while rswETH printed near 1.138, about 5% above its 1.082 baseline. The team said on X that returning net asset value “to the correct value” is the next step before it reopens the two tokens.
As we continue to work with our security partners and Seal911 to fully secure our infrastructure, we have paused deposits and withdrawals for swETH and rswETH. The next step to resume normal operations is to return NAV to the correct value, after which we will resume deposits and withdrawals. All funds are safe, and we are working carefully with our security partners to resume operations securely. We advise you to exercise increased vigilance at this time and to follow only communications from official channels. Events like this can lead to an increase in phishing attempts.
— Swell (@swellnetworkio) October 23, 2026
The pause landed two days after the first red flag. On Wednesday, October 21, on-chain analyst Spreek wrote that the admin keys controlling the two tokens appeared to be compromised and that the net asset value was being raised by up to 1% an hour without backing. Swell acknowledged the reports the next day, telling holders “no ETH has left the swETH or rswETH withdrawal or deposit contracts” and that no action was required while it investigated with security partners.
We are aware of reports of suspicious activity on the swETH and rswETH contracts. Our team is investigating now with our security partners and taking all necessary precautions. No ETH has left the swETH or rswETH withdrawal or deposit contracts. No action is required.
— Swell (@swellnetworkio) October 22, 2026
What a Broken Exchange Rate Does to a Staking Token swETH and rswETH are both receipts for ETH deposited with the Swell protocol. The exchange rate is the mechanism that decides how many tokens a depositor receives on the way in and how much ETH they get back on the way out. When that rate is inflated, a holder can redeem more ETH than was actually deposited behind their tokens. That is precisely the failure the team moved to shut down: by freezing deposits and withdrawals, Swell blocks anyone from cashing out an inflated rate before the accounting is corrected.
The size of the distortion matters because it sets the upper bound on what an exploit could extract if the inflated rate were honored. At the contract-reported rates of 1.203 and 1.138, the two tokens sat roughly 6.2% and 5.2% above the last clean net asset values Spreek identified. In dollar terms, Spreek estimated the malicious upgrade contracts he flagged could steal approximately 2,500 ETH, or about $5.9 million at Ethereum’s recent price near $2,360 per CoinGecko.
The Discount the Market Is Already Pricing Traders did not wait for the protocol to explain itself. On secondary markets, swETH changed hands at about 1.089 WETH in a Uniswap pool with roughly $143,000 of liquidity, while rswETH fetched near 1.029 WETH on Curve. Against the contract rates, that is a discount of about 9.5% for swETH and 9.6% for rswETH.
That gap is the market pricing uncertainty that arbitrage normally would erase in minutes. In a healthy state, a token trading below its net asset value invites traders to buy the discounted token and redeem it at par, pulling the price back in line. With withdrawals frozen, that redemption path is closed, so the discount persists as a pure read on how much confidence holders have that the rate will be corrected. The number to watch is not the contract rate but the spread between the two: a narrowing spread would signal that the market believes a reopening is close.
What Spreek Says Was Compromised The mechanics of the suspected attack, as described by Spreek on X, were straightforward and have not yet been confirmed by Swell. He wrote in a post on X that admin keys for the Swell DAO’s two tokens “appear to be compromised,” that four malicious upgrade contracts had been deployed, and that those contracts could drain roughly 2,500 ETH if queued through the multisig. He added the key qualifier: the four contracts were “not queued yet through multisig,” meaning the final step that would have armed them had not been taken.
Swell has not confirmed a cause, a compromised key, or a loss figure. What it has said is that the infrastructure is being secured with Seal911, a security response collective, and that no ETH has moved out of the affected contracts. That leaves the incident in the category of a prevented exploit rather than a completed drain, a distinction that will be settled only when the team publishes its account of what happened.
What the Pause Does Not Mean The suspension is not evidence that funds were stolen, and it is not a permanent halt. Swell’s own words were explicit on both points. “All funds are safe,” the team wrote in the Friday announcement, and the earlier statement said plainly that no ETH had left the withdrawal or deposit contracts. The pause is the protocol’s protective response to an accounting fault, which is a different category from the completed bridge drains that have hit other staking projects this year.
The contrast is useful. When the rsETH restaking protocol Kelp DAO lost funds in a bridge exploit earlier this year, it ended up suing bridge operator LayerZero over a $292 million loss. Swell, by pausing before any withdrawal could be honored at an inflated rate, appears to have stopped the event before it reached that stage. The protection is the pause itself.
What Has to Happen Before Withdrawals Reopen The reopening sequence is set: correct the net asset value of both tokens, then resume deposits and withdrawals. Swell has not published a date for either step, and it has told holders to expect phishing attempts to rise while the situation is unresolved. The only confirmed path back to normal is a corrected rate and a reopened withdrawal queue.
For holders of swETH and rswETH, the practical question is whether they can afford to wait on a protocol whose accounting is under repair. Liquid staking and restaking tokens exist to keep capital usable while it earns yield; a frozen withdrawal button removes that property. The concept of restaking and how these liquid receipts are supposed to work is explained in BlockchainReporter’s restaking explainer, but the immediate lesson from the Swell pause is simpler: a liquid token is only as liquid as its redemption path, and when that path closes, the discount is the price of the uncertainty.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
AUTHOR
Blockchain analyst specializing in the regulatory impact of government policies on the crypto industry. Known for his thorough research and clear, engaging writing, Emmanuel provides insightful analysis on the latest trends, market shifts, and emerging crypto innovations. His work aims to educate and inform both novice and experienced readers, offering expert perspectives on the fast-evolving world of digital assets. With a passion for staying ahead of the curve, Ogwu is a trusted voice in the cryptocurrency and blockchain space.