---
title: "Swell Network Hot Keys Compromised as Attacker Manipulates Token Exchange Rates"
description: "An intruder seized 30 operational keys, inflating swETH and rswETH rates and deploying unexecuted exploit payloads targeting 2,513 ETH."
url: https://basisdesk.news/news/swell-network-hot-key-compromise-oracle-manipulation
published: 2026-10-24T01:11:26.786Z
modified: 2026-10-24T01:11:26.786Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [ETH, SWETH, RSWETH]
tags: [swell, hot-keys, oracle-manipulation, liquid-staking, eigenlayer]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Swell Network Hot Keys Compromised as Attacker Manipulates Token Exchange Rates

An intruder seized 30 operational keys, inflating swETH and rswETH rates and deploying unexecuted exploit payloads targeting 2,513 ETH.

## At a glance

- **What happened:** An unknown actor seized 30 Swell hot keys on Oct. 21, manipulating oracle bots to artificially inflate swETH and rswETH rates.
- **Why it matters:** The breach placed 2,513 ETH at risk and redirected staking rewards, though a seven-day timelock has stopped direct contract drains.
- **Who is affected:** Swell protocol participants, swETH and rswETH holders, and secondary decentralized exchange liquidity pools.
- **What's next:** Protocol administrators must rotate compromised keys across four chains without triggering contract lockdown pauses.
- **Primary source:** [test/Swell hot-key compromise incident report.md at main · Spreek/test](https://github.com/Spreek/test/blob/main/Swell%20hot-key%20compromise%20incident%20report.md) — github.com

## Key points

- An attacker gained control of 30 Swell operational hot keys across four blockchains starting on Oct. 21.
- The compromised oracle bot increased swETH and rswETH exchange rates by 1% per hour, adding over 580 unbacked ETH to reported balances.
- Roughly 2,513 ETH in protocol contracts remains protected by a seven-day timelock that has no queued malicious upgrades.

## Editorial remark

- **Context:** The incident highlights systemic vulnerabilities in operational bot automation, where key management failures can bypass rate controls despite external proof-of-reserve mechanisms being disabled.
- **Impact:** Holders of swETH and rswETH face pricing discrepancies across decentralized markets, while Swell must orchestrate an emergency rotation of dozens of operational keys across multiple networks.
- **Watch:** Monitor Swell's 4-of-7 Safe multi-signature activity and timelock contract to verify hot-key revocation and whether emergency lockdown procedures are initiated.

An unknown actor gained control of liquid staking protocol Swell's operational hot keys on Oct. 21, systematically manipulating oracle feeds to artificially inflate token exchange rates without backing assets, according to an on-chain incident report published by on-chain analyst Spreek [1]. At the time of writing, $ETH traded near $2,374.

The intrusion began around 14:25 UTC on Oct. 21, eventually encompassing 30 protocol operational hot keys spanning Ethereum, Arbitrum, Base, and HyperEVM [1]. By 23:02 UTC, the actor began using the compromised oracle bot key to raise the exchange rates of both $SWETH and $RSWETH by the on-chain maximum limit of 1% per hour [1]. Through consecutive hourly adjustments, the attacker inflated swETH reserves by 349.2 unbacked ETH and rswETH by approximately 232 unbacked ETH by reporting fabricated balances that lacked external proof-of-reserve verification [1].

Beyond rate manipulation, the attacker redirected future EigenLayer rewards across 40 rswETH StakerProxy contracts to a designated hub wallet and moved $392,891 from a HyperEVM liquidity vault into a sub-account using a compromised strategist key [1]. The entity also deployed four malicious upgrade payloads designed to drain roughly 2,513 $ETH—worth approximately $6.2 million—from Swell's deposit and withdrawal contracts [1].

## Safeguards Prevent Direct Treasury Drain

Despite the breach of operational keys, the core protocol deposits have not been siphoned [1]. Executing the malicious contract upgrades requires approval through Swell's seven-day timelock governed by a 4-of-7 multi-signature Safe, and as of 01:20 UTC on Oct. 22, no upgrade proposals had been submitted to the timelock queue [1]. Furthermore, no secondary protocol venues or lending markets using the affected assets had experienced successful drain exploits [1].

Remediation remains constrained by protocol design: any manual downward repricing automatically triggers an internal lockdown mechanism that halts all redemptions, while pending withdrawal requests remain dependent on bot-level execution [1]. Protocol administrators must cycle the compromised key set across all four affected networks to neutralize further oracle updates [1].

## Sources

1. [test/Swell hot-key compromise incident report.md at main · Spreek/test](https://github.com/Spreek/test/blob/main/Swell%20hot-key%20compromise%20incident%20report.md) — github.com, 2026-10-22

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai