Swell DAO's swETH and rswETH management keys are suspected to have been leaked, and attackers have deployed 4 malicious upgrade contracts.

According to security researcher Spreek (@spreekaway), the administrative keys for swETH and rswETH under Swell DAO appear to have been compromised. Attackers are inflating the NAV (Net Asset Value) without asset backing by up to 1% per hour. Four malicious upgrade contracts have been deployed and are queued for multisig execution; if executed, they could result in the theft of approximately 2,500 ETH. Furthermore, analysis by ADL (@ADLXBT) indicates that the management keys control proxy administrator permissions. Once seized by attackers, these keys could allow the redirection of swETH/rswETH proxies to malicious implementation contracts, triggering minting or withdrawal functions to artificially inflate the NAV without corresponding asset backing. Spreek noted that any connection between this incident and the Railway platform remains speculative, with only a coincidental timeline observed and no concrete evidence available. The incident report he published was generated by Claude, and certain portions remain unverified.