Skip to content

Near-miss · Oct 22, 2026 · Keeper, oracle or market-maker bot

Swell oracle bot and operational hot keys taken over, swETH and rswETH rates pushed up without backing

Amount
No loss reported
no confirmed loss; about 2,513 ETH in Swell contracts was described as exposed to four malicious upgrade contracts that had not executed
Affected
Swell
Chains
Ethereum
Status
Reported by credible sources

What happened

Security researcher Spreek reported that an unidentified actor controlled Swell's operational hot keys, including the oracle bot that sets swETH and rswETH exchange rates, as of 21 October 2026 (US Eastern time; 22 October UTC), and raised both rates at the 1% hourly cap with no new ETH backing. Crypto Briefing and Unchained reported four malicious upgrade contracts that could reach about 2,513 ETH had been deployed but not executed. Swell said no ETH left the deposit or withdrawal contracts and paused deposits and withdrawals for both tokens on 23 October.

Why it happened

  • Key exposure

    A private key, seed or API key leaked from a repo, server, environment, log or prompt.

    Ask of your own agent: If one agent key leaked tonight, how much could walk out?

  • Stale or bad data

    The agent acted on a stale, wrong or manipulated price or data feed.

    Ask of your own agent: How old is the price your agent just acted on?

Free checks for this pattern, in your browser:

Sources

  1. Researchers flag inflated swETH and rswETH rates after Swell hot key compromiseCrypto Briefing · news · Oct 22, 2026 · I checked the page: it names this incident Nov 8, 2026
  2. Swell Freezes swETH and rswETH Withdrawals Until It Corrects Their Exchange RatesUnchained · news · Oct 23, 2026 · I checked the page: it names this incident Nov 8, 2026

Added Nov 8, 2026, last updated Nov 8, 2026. I wrote this from the sources above; nothing here goes beyond what they report. Involved in this incident, or see an error? Send a correction or a reply; replies from affected parties are added to the entry, dated.

Could the same thing happen to your agent?

Send me one real agent workflow. In my free 48-hour integration review I go through it end to end against this incident's pattern (key exposure, stale or bad data) and send you a written report: where the same path exists, what would stop it, and the tests that prove it.

Request the free 48-hour review

This is a record of public reports, not a security audit, legal, compliance or investment advice. Names appear only as the sources report them.