Swell exchange rates "legitimately pushed up": hot key suspected compromised, swETH/rswETH rates raised without backing
On October 22, Spreek disclosed that a Swell DAO operational hot key was suspected of being compromised. Someone repeatedly raised the swETH/rswETH exchange rates, up to the 1% hourly limit, without any additional ETH backing. Phylax founder Odysseus counted five increases in total (three for swETH and two for rswETH), describing it as "BOT key abuse"—the oracle only allows the BOT role to submit repricing snapshots, and the bot runs on a hot key.
On-chain records show that the same address has submitted snapshots consecutively since 23:02 UTC on October 21. As of October 22, swETH was about 3.0% above its baseline of 1.133254 ETH, while rswETH was 2.0% above its baseline of 1.082464 ETH.
A few hours ago, Railway acknowledged an anomaly in its environment-variable storage system: external parties may have accessed decrypted key contents. Railway then froze all deployments and urged users to rotate their keys. On the same day, on-chain investigator Tay said attackers had used Railway-related keys to transfer about $371,000 from wallets across at least 19 EVM chains, though the connection between the two incidents has not been confirmed.
Spreek also found four malicious upgrade contracts that could have drained about 2,500 ETH if executed. Odysseus estimates that the contracts hold 2,513 ETH, emphasizing that the losses are “unconfirmed.” Fortunately, none of the contracts were executed. On October 22, Swell said its deposit and withdrawal contracts had “no ETH outflows.” On October 23, it paused deposits and withdrawals for two tokens pending a recovery in net asset value.
The potential contagion path warrants even greater caution: each product has a TVL of about $29 million. If lending markets value collateral using an inflated exchange rate, the risk could spread further—KelpDAO’s rsETH incident has already shown how this can happen.
Hot wallets manage oracles, and oracles feed data to lending markets. A single key leak can turn into a systemic risk for DeFi. Who will be the next asset to be “legitimately pumped”?
$ETH $SWELL $EIGEN
(Source: Cryptopolitan)
⚠️Risk reminder: The above is shared for informational purposes only and does not constitute investment advice. Investing involves risk; exercise caution when entering the market.