Swell Network Admin Keys Compromised: 2,500 ETH at Risk from Attack

The liquid staking protocol Swell DAO is currently facing a significant security threat following the suspected compromise of its administrative keys. Reports from on-chain security analysts indicate that unauthorized entities have gained control over functions governing swETH and rswETH tokens. The exploit involves the deployment of malicious upgrade contracts that, if executed, could lead to the theft of approximately 2,500 ETH, valued at several million dollars at current market rates.

Mechanism of the Exploit and NAV Manipulation

According to data provided by the anonymous security analyst Spreek, the attacker has initiated a process to artificially inflate the Net Asset Value (NAV) of the affected tokens. The protocol's parameters are currently being adjusted to increase the NAV by up to 1% per hour without any underlying asset backing. This manipulation creates a discrepancy between the token's reported value and the actual collateral held within the smart contracts.

Beyond value manipulation, the attacker has successfully deployed four malicious upgrade contracts. These contracts serve as the primary vehicle for the potential theft of funds. The current status of the threat includes:

• Deployment of unauthorized smart contracts targeting the Ethereum mainnet.
• Artificial inflation of token exchange rates to facilitate drainage.
• Attempts to bypass standard governance protocols to execute the upgrade.

Current Mitigation and Potential Vector

While the malicious contracts have been deployed, they have not yet entered the execution queue through the required multi-signature (multi-sig) process. This delay provides a critical window for the Swell DAO team and security partners to intercept the transaction before the 2,500 ETH is permanently moved. Multi-signature wallets typically require several authorized parties to sign off on a transaction, acting as a safeguard against single-point-of-failure attacks.

Regarding the origin of the breach, Spreek noted a possible correlation with the cloud deployment platform Railway. However, this remains speculative and is based on timing coincidences rather than technical certainty.

This incident may be related to the cloud deployment platform Railway, but this is merely due to coincidental timing and there is no conclusive evidence at this stage.

The situation remains fluid as developers monitor the blockchain for any movements within the multi-sig architecture. Users of Swell’s liquid staking and restaking derivatives are advised to stay informed through official protocol channels while the security audit of the compromised keys continues. This incident highlights the ongoing vulnerabilities associated with admin key management in decentralized finance (DeFi) ecosystems.