Swell DAO's swETH and rswETH management keys are suspected to have been leaked, and attackers have deployed 4 malicious upgrade contracts.

On October 22, security researcher Spreek (@spreekaway) disclosed that the management keys for swETH and rswETH under Swell DAO appear to have been compromised. Attackers are artificially inflating the NAV (net asset value) unsupported by underlying assets at a rate of up to 1% per hour. Four malicious upgrade contracts have currently been detected deployed, but they have not yet reached execution via the multi-sig queue. If executed, they could drain approximately 2,500 ETH.

Furthermore, according to analysis by ADL (@ADLXBT), the management key controls proxy admin privileges. If compromised, attackers could redirect the swETH/rswETH proxy to a malicious implementation contract, triggering mint or withdraw functions and artificially inflating the NAV without corresponding asset backing.

Spreek noted that whether this incident is connected to the Railway platform remains speculative and currently appears to be merely a timing coincidence, with no concrete evidence available. The incident report he published was generated by Claude, and certain portions remain unverified.