# Swell pauses swETH and rswETH withdrawals Author: Hatice Ertaş Language: English Published: 2026-10-24T15:42:41+03:00 Updated: 2026-10-24T15:42:41+03:00 ![Closed metal valves in blue and turquoise channels beside an Ethereum symbol; a conceptual technology scene.](https://kriptometa.com/uploads/swell-sweth-ve-rsweth-cekimlerini-durdurdu-a9374b4abb90_article.webp) ## Key takeaways - The October 23 pause covers swETH and rswETH deposits and withdrawals. Swell has not given a reopening date. - Swell says funds are safe. The team has not confirmed researchers’ allegations about administrator keys and NAV increases. - Normal withdrawal estimates in the documentation do not establish when the pause will end; the team warns about phishing attempts. Swell halted deposits and withdrawals for its two Ethereum staking tokens. The team says it will correct NAV before reopening and is working with security partners. Swell paused deposits and withdrawals for its Ethereum staking tokens swETH and rswETH. In its [October 23 announcement](https://x.com/swellnetworkio/status/2113520767665307910), the team said it would correct the tokens’ net asset value, or NAV, before restoring access. Swell is working with its security partners and SEAL 911 to secure its infrastructure. It has not announced a reopening date or time. The pause was announced at 06:39 UTC on October 23. It covers deposits and withdrawals for the two tokens through the protocol. Swell did not announce a halt to all Ethereum transfers or to every activity involving the separate SWELL token. ## Withdrawals stopped a day after the first warning In its [initial October 22 notice](https://x.com/swellnetworkio/status/2113103884885561610), Swell said it was investigating reports of suspicious activity on the swETH and rswETH contracts with security partners. At that point, it said no ETH had left the deposit or withdrawal contracts and no user action was required. On October 23, Swell announced that it had paused deposits and withdrawals and would correct NAV before reopening. Swell’s two official notices, checked on October 24. Times are in UTC. | Notice | Reported status | User access | |---|---|---| | October 22, 03:03 | Security partners were investigating suspicious contract activity. | The team said no user action was required at that point. | | October 23, 06:39 | The team would reopen deposits and withdrawals after correcting NAV. | swETH and rswETH deposits and withdrawals paused; no date given. | > “All funds are safe.” Swell’s October 23 statement. The team’s assurance has not been independently verified. When Swell said on October 22 that no ETH had left, it was referring to the swETH and rswETH deposit and withdrawal contracts. The team has not published a technical cause, the amount by which NAV needs correcting or a date for restoring access. [Swell’s October 23 pause announcement](https://x.com/swellnetworkio/status/2113520767665307910) ## NAV helps determine how much ETH a token represents swETH is a [liquid staking token](https://kriptometa.com/en/glossary/liquid-staking) representing ETH staked through Swell. [rswETH is a liquid restaking token](https://docs.swellnetwork.io/swell-staking/rsweth-liquid-restaking): ETH held in Ethereum validators is restaked through EigenLayer to help secure additional services. Swell’s documentation describes rswETH as an [ERC-20 token](https://kriptometa.com/en/glossary/token-networks-standards) representing ETH that accrues staking rewards: the amount of ETH represented by each token changes as rewards accumulate. Swell issues swETH and rswETH as separate tokens. NAV stands for net asset value. Swell uses NAV to calculate the amount of ETH represented by each token. [Swell’s swETH exchange-rate documentation](https://docs.swellnetwork.io/swell-staking/sweth-liquid-staking/sweth-v1.0-system-design/staking-with-sweth/exchange-rate) says the protocol bases the rate on ETH staked on Ethereum’s consensus layer, including rewards. According to the document, a Chainlink proof-of-reserve oracle supplies the daily ETH balance. Swell uses the balance to calculate how much swETH to mint on deposit and how much ETH to return on redemption. An [oracle](https://kriptometa.com/en/glossary/what-is-blockchain-oracle) delivers external data to a smart contract. The example table increases the ETH represented by one swETH from 1.0 to 1.3 across successive months to illustrate the calculation. Those figures are neither a current exchange rate nor a promised return. The protocol’s ETH exchange rate is also distinct from the price available on a [decentralized exchange](https://kriptometa.com/en/glossary/decentralized-exchange-dex). Swell’s withdrawal documentation says a secondary-market swap may execute at a different price from the protocol’s redemption rate. ## Administrator-key allegations remain unconfirmed Security researcher Spreek [suggested on October 22](https://x.com/spreekaway/status/2113079969295593976) that administrator keys for swETH and rswETH might have been compromised. The researcher alleged that NAV was being raised without backing by the maximum permitted 1% each hour. Spreek also said four malicious upgrade contracts capable of taking roughly 2,500 ETH had been deployed, but had not yet been queued through the multisignature wallet. The roughly 2,500 ETH figure is the researcher’s estimate of potential exposure, not a reported loss. Spreek raised a possible Railway connection as a question. Swell did not confirm compromised administrator keys or a Railway link in its October 22 and 23 statements. KriptoMeta has not independently tested the contracts. Railway’s [own October 21 security disclosure](https://blog.railway.com/p/security-disclosure-wednesday-october-21st) reported anomalous activity in systems storing customer environment variables. Its initial investigation indicated that an unauthorized party might have accessed encrypted values and, in some cases, decrypted contents. Environment variables can contain API keys and database credentials. The disclosure does not name Swell, and Railway has not been established as the cause of Swell’s incident. ## Normal withdrawal estimates are not a reopening timetable Swell’s [swETH withdrawal documentation](https://docs.swellnetwork.io/swell-staking/sweth-liquid-staking/sweth-v1.0-system-design/withdrawals) says withdrawals normally take 1–7 days, with some taking 12 days or longer. An ETH buffer funded by new deposits and validator rewards can meet some requests without waiting for validators to exit. If requests exceed the buffer, validators must wait in Ethereum’s exit queue. The network then pays eligible balances in turn, which can add to the wait. **There is no deadline for lifting the pause.** The normal 1–7 day estimate does not set a completion date for the security investigation or NAV correction. Swell says deposits and withdrawals will resume after the correction, but has not said when the correction will finish. The team warned that the incident could attract more [phishing attempts](https://kriptometa.com/en/crypto-phishing-fake-token-checks). It asked users to be more vigilant and follow communications only from official channels. Swell’s pause notice contains no instruction to send funds to another address or share [private keys](https://kriptometa.com/en/glossary/private-key).