Swell pauses swETH and rswETH deposits and withdrawals after abnormal exchange rates raise security concerns, while the team investigates potential contract risks.
Swell suspended deposits and withdrawals for swETH and rswETH on October 23, 2026, after contract rates rose 5% to 6% above verified levels. The Ethereum staking protocol also paused some of its operations as it investigated a suspicious upgrade contract that could compromise 2,513 ETH.
Swell Investigates Abnormal Token Rates and Possible Security Risks
According to Unchained, the swETH contract was trading at about 1.203 ETH at 4:48 p.m. ET on Friday. In the meantime, rswETH was trading at approximately 1.138 ETH, which has raised concerns regarding potential contract manipulation.
Swell Pauses swETH and rswETH Deposits and Withdrawals Amid Abnormally High Contract Exchange Rates
According to Unchained, Ethereum staking protocol Swell has paused deposits and withdrawals for swETH and rswETH until it corrects the net asset values (NAV) and exchange rates of… pic.twitter.com/p6J5mY6Koo
— Wu Blockchain (@WuBlockchain) October 24, 2026
These rates were approximately 6% and 5% higher than rates previously verified. On-chain analyst Spreek found the previous clean rates to be 1.133 ETH for swETH and 1.082 ETH for rswETH.
Read more: Ekubo Hack Drains $1M in WBTC as Users Urged to Revoke Approvals – Ledger Tribune
The token prices on decentralized exchanges, however, had different values. SwETH was offered at roughly 1.089 WETH on a Uniswap pool where there was approximately $143,000 in liquidity. In the meantime, rswETH was trading around the 1.029 WETH price on Curve.
The discrepancy between the contract rates and trading prices sparked some doubts about the reported values of the tokens. But the differences do not constitute proof of an exploit being successful or of money being stolen.
Security researchers also found 4 malicious upgrade contracts that were said to be queued via Swell’s timelock system. The execution of these contracts could have left around 2,513 ETH vulnerable to theft, according to the reports.
The reported issues were administrative keys or repricing keys that are attached to the affected contracts. The suspected compromise was reportedly caused by a leaked key on the Railway cloud platform, but the exact reason is still being investigated.
Swell Freezes Contract Operations While Investigation Continues
On October 23, Swell froze relevant contract operations to stop any further deposits, withdrawals, and final ETH claims. As a result, users will not be able to do these until the team gets the problem fixed and everything is back to normal.
No ETH has been withdrawn from the affected main contracts, Swell said. The team said, therefore, that the underlying funds were not affected when it announced the suspension.
The protocol also collaborated with security partners such as Seal911 to investigate the incident and secure the infrastructure. But the team hasn’t released a full explanation for how the dubious upgrade contracts came about.
DefiLlama reports that swETH and rswETH were worth around $29 million each. The numbers show the potential size of the incident, but do not prove that either suffered losses.
In addition, Swell has not yet stated a definite reopening date or given specific guidelines on how to trade and provide liquidity. Users are advised to check the official project announcements for updates on service restoration.
The team also cautioned that the incident might be a target for phishing attacks. Users should only use trusted Swell channels and not respond to suspicious messages that ask for wallet access or recovery phrases.
Swell’s focus at this time is on fixing the abnormal exchange rates and figuring out how the questionable upgrade contracts got in the system. The investigation should determine the cause and the circumstances under which deposits and withdrawals can be resumed.
Swell did not report any ETH outflows from the affected contracts, but the investigation continues. Further updates should establish whether additional corrective measures are necessary before normal operations return.
I am a crypto news writer focused on blockchain updates, market trends, and digital asset developments. I write clear and simple articles that help readers understand the fast-moving crypto world.