Spreek, a security researcher, said on October 22 that someone with Swell DAO’s operational hot keys pushed up the exchange rates of its swETH and rswETH liquid staking tokens at the 1% hourly cap without any new ETH behind them.

The reports emerged hours after cloud platform Railway revealed that an intruder might have accessed stored secrets of customers.

Odysseus counted five hikes of about 1% across both tokens

Spreek shared the findings on X at 01:28 UTC, saying the admin keys for both tokens “appear to be compromised (railway related?)”. Attackers were “raising NAV by max 1% (unbacked) each hour,” the post said.

Phylax Systems founder Odysseus called it “BOT-key abuse,” noting three swETH and two rswETH rate hikes of about 1% apiece. Swell’s published oracle code confines submission of repricing snapshots to the BOT role only.

That bot runs on hot keys. Hot keys are online and sign without a human.

Ethereum records show one address submitting swETH snapshots at 23:02 UTC on October 21 and then again at 00:04 and 01:08 UTC on October 22. Reported numbers as of October 22 show swETH around 3.0% above 1.133254 ETH.

rswETH was up about 2.0% from 1.082464 ETH.

Railway said on Oct. 21 that it observed anomalous activity in systems that store customer environment variables and that an outsider may have had access to decrypted contents for some. Among the secrets stored there are API keys and registry credentials.

The platform froze all deployments and urged all users to roll stored secrets.

The same day, crypto investigator Tay said an attacker had drained around $371,000 from wallets on at least 19 EVM chains with keys stored on Railway. There has been no confirmation of a tie between the Railway breach and Swell.

Four malicious upgrade contracts could take about 2,500 ETH

Swell said on X at 03:03 UTC on Oct 22, it was aware of reports of “suspicious activity on the swETH and rswETH contracts” and was investigating with its security partners. “No ETH has left the swETH or rswETH withdrawal or deposit contracts,” the team wrote, adding no action was needed.

Swell paused deposits and withdrawals for swETH and rswETH on October 23 and said it would resume them once NAV returns to the correct value.

Spreek also reported four malicious upgrade contracts deployed that could take around 2,500 ETH if executed. Odysseus reckoned that Swell was holding 2,513 ETH, adding that the amount “is NOT confirmed loss.”

At the time of the reports, none of the upgrades had been run.

Some of the details in the research were reportedly compiled with AI assistance and are unverified.

Only a fraction of higher rates is reportedly priced into DEX prices. Swell’s liquid staking and liquid restaking products each held around $29 million in total value locked on October 23, while data sources point to a market cap for rswETH between $27 million and $58 million.

In a lending market that prices swETH or rswETH off the on-chain rate, that inflated number would count as collateral. Cryptopolitan tracked the same contagion path with KelpDAO’s rsETH exploit spreading to Layer 2 lending markets.

Leaked keys were also behind the Fearless Wallet extension that sent the private keys of Polkadot users to an attacker’s server.

If you’re reading this, you’re already ahead. Stay there with our newsletter.