Swell Network Hot Keys Compromised as Attacker Manipulates Token Exchange Rates

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

An intruder seized 30 operational keys, inflating swETH and rswETH rates and deploying unexecuted exploit payloads targeting 2,513 ETH.

Key points

• An attacker gained control of 30 Swell operational hot keys across four blockchains starting on Oct. 21.
• The compromised oracle bot increased swETH and rswETH exchange rates by 1% per hour, adding over 580 unbacked ETH to reported balances.
• Roughly 2,513 ETH in protocol contracts remains protected by a seven-day timelock that has no queued malicious upgrades.

An unknown actor gained control of liquid staking protocol Swell's operational hot keys on Oct. 21, systematically manipulating oracle feeds to artificially inflate token exchange rates without backing assets, according to an on-chain incident report published by on-chain analyst Spreek [1]. At the time of writing, $ETH traded near $2,374.

The intrusion began around 14:25 UTC on Oct. 21, eventually encompassing 30 protocol operational hot keys spanning Ethereum, Arbitrum, Base, and HyperEVM [1]. By 23:02 UTC, the actor began using the compromised oracle bot key to raise the exchange rates of both $SWETH and $RSWETH by the on-chain maximum limit of 1% per hour [1]. Through consecutive hourly adjustments, the attacker inflated swETH reserves by 349.2 unbacked ETH and rswETH by approximately 232 unbacked ETH by reporting fabricated balances that lacked external proof-of-reserve verification [1].

Beyond rate manipulation, the attacker redirected future EigenLayer rewards across 40 rswETH StakerProxy contracts to a designated hub wallet and moved $392,891 from a HyperEVM liquidity vault into a sub-account using a compromised strategist key [1]. The entity also deployed four malicious upgrade payloads designed to drain roughly 2,513 $ETH—worth approximately $6.2 million—from Swell's deposit and withdrawal contracts [1].

Safeguards Prevent Direct Treasury Drain

Despite the breach of operational keys, the core protocol deposits have not been siphoned [1]. Executing the malicious contract upgrades requires approval through Swell's seven-day timelock governed by a 4-of-7 multi-signature Safe, and as of 01:20 UTC on Oct. 22, no upgrade proposals had been submitted to the timelock queue [1]. Furthermore, no secondary protocol venues or lending markets using the affected assets had experienced successful drain exploits [1].

Remediation remains constrained by protocol design: any manual downward repricing automatically triggers an internal lockdown mechanism that halts all redemptions, while pending withdrawal requests remain dependent on bot-level execution [1]. Protocol administrators must cycle the compromised key set across all four affected networks to neutralize further oracle updates [1].

Sources

1. test/Swell hot-key compromise incident report.md at main · Spreek/test — Primary document (discovered)

---

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.