⚠️ Security Alert: Swell’s swETH / rswETH admin keys suspected to be compromised; approximately 2,500 $ETH are at risk
On October 22, security researcher Spreek disclosed an anomaly on X. PANews, TechFlow, Wu Says, and others followed up. Here are the key points:
1. Assets involved: Swell DAO’s liquid staking token swETH and restaking token rswETH. The issue concerns the contracts’ administrator (proxy upgrade) permissions.
2. Anomalous activity: According to the disclosure, the attacker is raising the net asset value (NAV) of assets with no backing by as much as approximately 1% per hour.
3. Potential losses: Four malicious upgrade contracts have been found deployed, but they have not yet entered the execution queue via multisig. If executed, they could drain approximately 2,500 $ETH .
4. Cause unknown: Some have speculated that this is related to a security incident involving cloud deployment platform Railway, but Spreek said it was merely a coincidence in timing, and there is no conclusive evidence so far. At the time of writing, Swell has not issued a full official statement.
Anyone holding swETH / rswETH, or using them as collateral in lending protocols or LPs, should closely monitor Swell’s official X account and Discord announcements and assess their exposure. $SWELL holders should also keep an eye on upcoming governance developments.
For informational purposes only; not investment advice. DYOR. Use official channels only, and don’t click unfamiliar “compensation/claim” links.
#Swell #DeFi安全 #流动性质押 #ETH #OnchainSecurity
On October 22, security researcher Spreek disclosed an anomaly on X. PANews, TechFlow, Wu Says, and others followed up. Here are the key points:
1. Assets involved: Swell DAO’s liquid staking token swETH and restaking token rswETH. The issue concerns the contracts’ administrator (proxy upgrade) permissions.
2. Anomalous activity: According to the disclosure, the attacker is raising the net asset value (NAV) of assets with no backing by as much as approximately 1% per hour.
3. Potential losses: Four malicious upgrade contracts have been found deployed, but they have not yet entered the execution queue via multisig. If executed, they could drain approximately 2,500 $ETH .
4. Cause unknown: Some have speculated that this is related to a security incident involving cloud deployment platform Railway, but Spreek said it was merely a coincidence in timing, and there is no conclusive evidence so far. At the time of writing, Swell has not issued a full official statement.
Anyone holding swETH / rswETH, or using them as collateral in lending protocols or LPs, should closely monitor Swell’s official X account and Discord announcements and assess their exposure. $SWELL holders should also keep an eye on upcoming governance developments.
For informational purposes only; not investment advice. DYOR. Use official channels only, and don’t click unfamiliar “compensation/claim” links.
#Swell #DeFi安全 #流动性质押 #ETH #OnchainSecurity