Yes. The reports indicate Swell's operational keys for swETH and rswETH, including the oracle bot, were compromised: the tokens' reported backing was raised by up to 1% per hour without corresponding ETH, and four malicious upgrade contracts were deployed. The incident report says about 2,513 ETH across four deposit and withdrawal contracts could be at risk if an upgrade were approved, but no upgrade was queued as of 01:20 UTC on 22 October (Spreek's incident report).

SwellswETHrswETHOct 22, 2026, 09:34 UTC

The unbacked NAV increases could let the attacker buy tokens below the falsely raised redemption value, process their own withdrawals at that rate, and block other holders' redemptions; the reported upgrade path could expose the larger contract balances. Security researcher 0xQuit reported that the ProxyAdmins sit behind a seven-day Swell Timelock administered by a 4/7 multisig, and said none of its seven signers had transacted since the attack began (0xQuit's assessment).

Swell said it was investigating with security partners and reported that no ETH had left the swETH or rswETH deposit or withdrawal contracts; its statement said no action was required (Swell's statement). The root cause, including the suggested Railway connection, remains unconfirmed in the reports.

Ask your own

Case file

Swell

swETH

rswETH

Answered Oct 22, 2026, 09:34 UTC

Sources 3

Research trace 12

The linked original X post
Latest posts of @spreekaway
Latest posts of @JohnJL18
The page leviathannews.xyz
Check for Swell's follow-up to its 03:03 UTC statement that it was investigating, and for independent updates on whether the reported compromise or asset movement has been confirmed.
These reads check for a later Swell statement and independent follow-up on the alleged key compromise, NAV inflation, and malicious upgrades. The latest results say Swell was investigating and reported no ETH leaving its deposit or withdrawal contracts, while an independent post says the root cause is unconfirmed.
The earlier results establish Swell's initial response and report no ETH leaving its deposit or withdrawal contracts, while independent posts describe the key compromise and upgrades as unconfirmed reports. These reads seek Swell's subsequent statement, incident details, and any corroborating follow-up on losses or upgrade execution.
These reads seek a later Swell status, any independent confirmation or correction of the reported compromise, the incident report's contract and transaction details, and the Ethereum token addresses needed for on-chain verification. Earlier results showed Swell said it was investigating and no ETH had left the deposit or withdrawal contracts; an independent post described the root cause as unconfirmed and the upgrades as not yet queued.
The incident report and follow-up posts say the hourly unbacked NAV changes occurred on-chain, upgrades remained unqueued, and no ETH had left the deposit or withdrawal contracts. These reads check the named transactions, current token data, and any newer Swell or independent status.
These reads check current swETH and rswETH market data, the technical assessment of the timelock and multisig risk, and any later Swell status. Earlier results say Swell was investigating and reported no ETH leaving the deposit or withdrawal contracts, while incident reports describe hourly unbacked NAV increases and unqueued malicious upgrades.
These reads check for a later Swell statement and independent confirmation of the admin-key compromise, any asset loss, and whether the reported attack paths remain active. Swell's last statement said it was investigating and that no ETH had left its deposit or withdrawal contracts; technical posts say the malicious upgrades were not queued, but warned that the unbacked NAV increases could enable extraction through arbitrage and redemptions.
The available reports establish the compromise and the risk; no further readable lead remains open.