Swell Investigates swETH, rswETH Activity After Spreek Warns of 2,500 ETH Risk

Security researcher Spreek warned that a suspected leak of Swell DAO’s admin keys could put about 2,500 Ether (ETH) tied to its liquid-staking token swETH and restaking token rswETH at risk if malicious upgrades are executed.

Spreek said four malicious upgrade contracts have been deployed and the tokens’ net asset value is being artificially raised by as much as 1% per hour. The upgrades have not entered a multisignature execution queue, and no theft has been confirmed.

Swell said it is investigating the activity with security partners and has taken precautionary measures. The protocol said no ETH has flowed out through the swETH or rswETH deposit and withdrawal contracts, and users do not need to take action.

The potential exposure concerns administrative control over the two products, while Swell’s update addresses whether ETH has left their deposit and withdrawal contracts. The reported threat therefore remains tied to whether the proposed upgrades are executed.