A liquid staking token is only as good as the number it prints. A depositor sends ETH to a protocol, receives a receipt token, and trusts that the token can later be exchanged for the same ETH plus whatever staking rewards it earned. That trust rests on one figure: the exchange rate the protocol’s contracts report. When that figure stops matching the ETH actually held, the product breaks. That is what happened at Swell this week.
On October 23, Swell paused deposits and withdrawals for its liquid staking token swETH and its liquid restaking token rswETH. The team said it was working with security partners, including the response collective Seal911, after the two contracts began quoting exchange rates that no longer matched the ETH behind them. swETH was reporting about 1.203 ETH per token, roughly 6% above its last clean reading of 1.133, while rswETH printed near 1.138, about 5% above its 1.082 baseline. Swell’s stated next step is to return net asset value to the correct level before reopening the two tokens.
The mechanics explain why a pause was the safe move. swETH and rswETH are repricing receipts: the exchange rate decides how many tokens a depositor gets on the way in and how much ETH a holder receives on the way out. If that rate is inflated, a holder can redeem more ETH than was actually deposited behind their token. Freezing deposits and withdrawals blocks anyone from cashing out at the broken rate before the accounting is corrected.
The first red flag came two days earlier. On October 21, on-chain analyst Spreek posted that the admin keys controlling the two tokens appeared compromised and that net asset value was being raised by up to 1% an hour without backing. Spreek later described four malicious upgrade contracts that he estimated could drain roughly 2,500 ETH, or about $5.9 million at Ethereum’s recent price near $2,360, while adding the key qualifier that the contracts were not yet queued through the multisig. Swell has not confirmed a cause, a compromised key, or any loss, and says no ETH has left the affected contracts. The incident sits in the category of a prevented exploit rather than a completed drain.
The market has already priced the uncertainty. With withdrawals frozen, the usual arbitrage that would pull a discounted token back to par cannot run, so swETH and rswETH traded at meaningful discounts to their contract rates on secondary markets. The number worth watching is the spread between the contract rate and the market price: a narrowing gap would signal that traders expect a reopening.
The practical lesson is simpler than the incident itself. A liquid token is only as liquid as its redemption path. The pause is not evidence that funds were stolen, and Swell has said all funds are safe. But it is a reminder that the wrapper is only as sound as the number it prints, and when that number is wrong, the only safe option is to close the exits first and explain later.
Source: BlockchainReporter.