Swell Pauses swETH and rswETH Deposits as Contract Rates Diverge from DEX Prices

Swell has paused deposits and withdrawals for swETH and rswETH while it works to correct their net asset values (NAV). The immediate issue is a widening gap between rates recorded by the tokens’ contracts and prices available in decentralized exchange pools. The team has not set a reopening time, and the cause of the rate changes remains unconfirmed.

The pause was announced at 2:39 a.m. ET Friday. Swell said restoring each token’s NAV “to the correct value” must happen before deposits and withdrawals resume. That leaves holders unable to use those protocol functions for now, while the exchange prices reported in the source remain below the contract rates.

Contract rates and pool prices differ

At 4:48 p.m. ET Friday, Unchained’s read of the contracts put swETH at about 1.203 ETH and rswETH at about 1.138 ETH. On-chain analyst Spreek had identified earlier rates of 1.133 ETH and 1.082 ETH, respectively, as the last clean readings. The Friday contract figures were roughly 6% higher for swETH and 5% higher for rswETH.

Trading pools showed lower prices. swETH fetched about 1.089 WETH in a Uniswap pool with roughly $143,000 of liquidity, while rswETH traded for about 1.029 WETH on Curve. These pool prices and contract rates are different measurements: a contract rate can reflect the token’s accounting value, while a pool price reflects trades in that pool and the liquidity available there. A gap between them can make it harder for holders to assess what they could receive in a transaction.

DefiLlama put the value held by the swETH protocol at about $29 million, with roughly the same amount in rswETH. Those figures indicate the scale of assets associated with the two products, but they do not establish how much could be withdrawn or sold during the pause. The reported Uniswap liquidity, meanwhile, was about $143,000, a much narrower measure tied to one pool.

Swell has not given guidance on trading or liquidity provision. Its public message said, “All funds are safe,” and warned that incidents of this kind can bring more phishing attempts. That statement is the team’s characterization; the source does not report an independent confirmation of the funds’ status.

Reports pointed to changing NAV values

The first public account in the source came from Spreek at 9:28 p.m. ET on Wednesday, Oct. 21. The analyst wrote that admin keys for both tokens appeared compromised and that NAV was being raised by “max 1% (unbacked) each hour” at the time. Spreek also said four malicious upgrade contracts had been deployed and could take about 2,500 ETH, but none had been queued through Swell’s multisig.

That distinction matters: the reported presence of upgrade contracts described a potential route to move funds, not a completed transfer. Odysseus, founder of Phylax Systems, described the incident as appearing to involve “BOT-key abuse” and stressed that the 2,513 ETH held “is NOT confirmed loss.” The amount associated with a contract or a possible attack path should not be read as evidence that the same amount was taken.

At 11:03 p.m. ET, Swell said it was investigating with security partners and that “no ETH has left the swETH or rswETH withdrawal or deposit contracts.” The later pause addressed deposits and withdrawals as Swell worked on the rates. The source provides no further technical explanation of how the rates changed, which permissions may have been involved, or what checks the team will require before reopening the contracts.

Possible service connection has not been established

Spreek and Odysseus raised a possible connection to Railway, a cloud deployment platform. Railway’s Oct. 21 security disclosure said an “unauthorized third party” may have accessed customers’ encrypted environment variables and read some of them in decrypted form. Railway’s disclosure did not name Swell, and Swell has not confirmed a connection or described the cause. The available reporting therefore leaves the relationship as a possibility raised by researchers, not an established explanation.

Spreek also shared an incident report that he described as AI-written and not fully checked. It said that, as of late Oct. 21, Aave, Spark and Fluid accepted neither token. It also reported that a Morpho market priced from the contract rate had about 34 ETH available to borrow. That detail points to a separate concern during a rate discrepancy: lending systems that rely on a contract value may show a different picture from exchange pools, with consequences for users interacting with those markets. The report’s own caveat means its findings should be treated as provisional.

The episode also comes amid wider attention to risks around restaking tokens and bridges. In April, LayerZero linked a $292 million exploit of the bridge for Kelp DAO’s rsETH token to North Korea’s Lazarus Group; Kelp DAO later sued LayerZero over the incident. That event is distinct from the Swell situation, and the source does not connect the two. It does show why the status of token contracts, bridges and the systems that control upgrades can matter across several layers of a staking product.

For swETH and rswETH users, the next concrete information to watch is whether Swell explains the rate correction, confirms the cause, and states what conditions must be met before deposits and withdrawals return. Until then, the gap between contract values and pool prices remains a practical constraint on judging these tokens’ current market value.

Related Listen: How Spark Escaped the KelpDAO Hack Before It Even Happened

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Source links: Swell pause notice, swETH pool, rswETH pool, swETH protocol data, rswETH protocol data, Spreek’s initial post, Odysseus’s assessment, Swell’s investigation update, Railway disclosure, Spreek’s incident report, coverage of the Kelp DAO bridge exploit, and coverage of Kelp DAO’s suit.