Wednesday morning, Swell told X it hadn't shut down. By Wednesday night, its admin keys appeared to belong to someone else.
At 9:28 PM ET, security researcher Spreek flagged that the admin keys for swETH and rswETH, Swell's liquid restaking tokens, looked compromised. He says the attacker was pushing the tokens' NAV up as much as 1% an hour with nothing backing it, and had deployed four malicious upgrade contracts that could drain about 2,500 ETH. None had been queued through the multisig yet.
Swell replied 95 minutes later: investigating with security partners, no ETH has left the withdrawal or deposit contracts, no action required.
His guess at a cause, a link to deployment platform Railway, is a timing hunch. He also says his write-up was drafted by Claude and is partly unverified.
Swell says no action is required. The multisig would like to keep it that way.