Swell Halts swETH and rswETH Deposits as It Reviews Exchange Rates

Swell pauses deposits and withdrawals

Swell has frozen deposits and withdrawals for swETH and rswETH while it works to correct their exchange rates. The pause, announced at 2:39 a.m. ET Friday, leaves holders unable to use the protocol’s deposit and withdrawal contracts. Swell said restoring each token’s net asset value (NAV) to “the correct value” must come before services reopen. That order makes the rate discrepancy the immediate operational issue, while leaving users without a stated timetable for access.

At 4:48 p.m. ET Friday, contract rates stood near 1.203 ETH for swETH and 1.138 ETH for rswETH, based on Unchained’s read of the contracts. On-chain analyst Spreek had identified 1.133 ETH and 1.082 ETH as the last clean rates, putting the current figures about 6% and 5% higher, respectively. A contract rate is not the same thing as a price at which a holder can sell: it reflects the protocol’s accounting, while market transactions show what buyers are currently willing to pay. Here, those measures are pointing in different directions.

Market prices were lower. swETH traded around 1.089 WETH in a Uniswap pool with roughly $143,000 in liquidity; rswETH changed hands near 1.029 WETH on Curve. DefiLlama puts the value held by each token at about $29 million: swETH and rswETH. Those pool prices and liquidity figures describe available trading venues, not a guaranteed exit price for every holder. In a thin pool, a larger sale can move the quoted price, so market access and stated NAV can diverge in ways that matter to users.

Swell hasn’t set a reopening date or issued guidance on trading or liquidity provision. The team said “All funds are safe” and warned users to expect more phishing attempts during the incident. That reassurance addresses the team’s stated view of fund safety, but it doesn’t answer when normal contract use will return or how the rate correction will be carried out.

Rate changes and reported key activity

The questions began Wednesday, Oct. 21. At 9:28 p.m. ET, Spreek reported that admin keys for both tokens appeared compromised and that NAV was rising by “max 1% (unbacked) each hour.” He said four malicious upgrade contracts had been deployed, with the capacity to take about 2,500 ETH, but none had been queued through Swell’s multisig. The distinction matters: a reported ability to move funds is not evidence that the funds were moved, and the report described a possible route for an attack rather than a confirmed loss.

Odysseus, founder of Phylax Systems, described the activity as possible “BOT-key abuse” and cautioned that the 2,513 ETH held “is NOT confirmed loss.” Swell said at 11:03 p.m. ET it was investigating with security partners and that no ETH had left the swETH or rswETH deposit or withdrawal contracts. The updates establish a sequence of claims and responses, not a final account of how the activity began. Until Swell explains the mechanism, the cause remains unresolved.

Cause and market exposure remain unclear

Spreek and Odysseus raised a possible connection to Railway, a cloud deployment platform. In an Oct. 21 security disclosure, Railway said an unauthorized third party may have accessed customers’ encrypted environment variables and read some in decrypted form. Railway did not name Swell, and Swell has not confirmed a connection or explained the cause. The timing and nature of the disclosure may make it relevant to investigators, but they don’t establish that Swell’s systems or keys were affected through Railway.

Spreek’s incident report, which he said was AI-written and not fully checked, found that Aave, Spark and Fluid did not accept either token as of late Oct. 21. It also estimated that a Morpho market using the contract rate had about 34 ETH available to borrow. Those details underscore why the gap between contract rates and market prices matters: the protocols’ exposure depends in part on how they value the tokens. The report’s caveat also matters; its findings are a snapshot that should be read as preliminary, not as a complete audit of every market or position.

For related context on rsETH risk, LayerZero linked a $292 million Kelp DAO bridge exploit in April to North Korea’s Lazarus Group; Kelp DAO later sued LayerZero over the incident. That history gives readers a reason to pay attention to how rsETH is priced and used across protocols, but it doesn’t show that the Swell incident shares the same cause. Swell’s immediate test is narrower: correct the token rates, then explain when deposits and withdrawals can resume.

What holders and markets need to know next

This is more significant than it looks because a token’s stated accounting rate can shape how other systems treat it, even when trading prices tell a different story. For holders, the pause means the protocol’s own contracts currently offer no deposit or withdrawal route. For outside markets, the key question is whether they rely on a token’s contract rate, a market quote, or some other valuation method. If you’re working in this space, the practical lesson is to distinguish a displayed NAV from an executable price.

Here’s the thing: reopening access will require more than a new rate figure. Users will need clear information about what changed, how Swell determined the corrected values, and whether the deposit and withdrawal contracts are ready to resume. That said, the available statements don’t yet provide those details. The current gap is a warning sign, not a full accounting of losses.

And the phishing warning deserves attention while users wait. During a disruption, people may search for urgent instructions or support, which can make false claims about withdrawals especially persuasive (and this is the part most people overlook). Check announcements against Swell’s established channels before acting. No access, for now.

Related Listen: How Spark Escaped the KelpDAO Hack Before It Even Happened

The post Swell Freezes swETH and rswETH Withdrawals Until It Corrects Their Exchange Rates appeared first on Unchained.