【Swell private key leaked, swETH NAV inflated by 1% per hour, 2,500 ETH at risk 😱🔥】
Join Mr. X’s fan group chat via the homepage 🔥
The NAV of Swell DAO’s swETH and rswETH is being artificially inflated by 1% every hour. On-chain analyst Spreek flagged the issue, which involves around 2,500 $ETH . At the current price of $2,397, that’s roughly $6 million. This isn’t stealing coins—it’s directly altering the ledger. 😱
The method is dirtier than you might think. Spreek identified four malicious upgrade contracts. They’ve already been deployed on-chain, but never made it into the multisig’s review queue. In other words, the final security gate was bypassed. The administrator’s private key may have been leaked. 🔥
The trail also leads to the developer platform Railway. Railway was attacked this week, and the company told all users to rotate their keys immediately. Some of its customers’ encrypted environment variables were decrypted into plaintext. It’s now unclear whose private keys were stored in them. 🧨
You don’t have to wait for the coins to be transferred for damage to occur. The inflated NAV can first be fed to oracles. Lending protocols then lend against that figure, making the collateral look more valuable than it really is. By the time on-chain monitoring catches it, the pool may already have been drained. 💀
There’s an ironic detail. Spreek said Claude helped draft the analysis. He acknowledged that some details haven’t been verified yet, but said the core assessment holds up. AI is now helping write on-chain alerts, at a frightening speed. 🤖
Put simply, staking tokens aren’t deposits. You think you’re holding $ETH , but really, you’re holding a ledger someone else wrote. Personally, I think this year’s DeFi blowups won’t come from smart contract code, but from private keys and operations. Whoever controls the upgrade permissions controls your money. 😤
📌 Once a private key leaks, the NAV can be changed at will—and that’s harder to detect than a code vulnerability.
Would you dare to check the permissions on your staking tokens right now?
Join Mr. X’s fan group chat via the homepage 🔥
The NAV of Swell DAO’s swETH and rswETH is being artificially inflated by 1% every hour. On-chain analyst Spreek flagged the issue, which involves around 2,500 $ETH . At the current price of $2,397, that’s roughly $6 million. This isn’t stealing coins—it’s directly altering the ledger. 😱
The method is dirtier than you might think. Spreek identified four malicious upgrade contracts. They’ve already been deployed on-chain, but never made it into the multisig’s review queue. In other words, the final security gate was bypassed. The administrator’s private key may have been leaked. 🔥
The trail also leads to the developer platform Railway. Railway was attacked this week, and the company told all users to rotate their keys immediately. Some of its customers’ encrypted environment variables were decrypted into plaintext. It’s now unclear whose private keys were stored in them. 🧨
You don’t have to wait for the coins to be transferred for damage to occur. The inflated NAV can first be fed to oracles. Lending protocols then lend against that figure, making the collateral look more valuable than it really is. By the time on-chain monitoring catches it, the pool may already have been drained. 💀
There’s an ironic detail. Spreek said Claude helped draft the analysis. He acknowledged that some details haven’t been verified yet, but said the core assessment holds up. AI is now helping write on-chain alerts, at a frightening speed. 🤖
Put simply, staking tokens aren’t deposits. You think you’re holding $ETH , but really, you’re holding a ledger someone else wrote. Personally, I think this year’s DeFi blowups won’t come from smart contract code, but from private keys and operations. Whoever controls the upgrade permissions controls your money. 😤
📌 Once a private key leaks, the NAV can be changed at will—and that’s harder to detect than a code vulnerability.
Would you dare to check the permissions on your staking tokens right now?