Unbacked inflation has hit two of Swell DAO's liquid staking tokens: the admin keys for swETH and rswETH appear to be compromised, with an attacker pushing the tokens' NAV higher by up to 1% every hour.

The keys control proxy admin permissions, which lets the holder point the swETH and rswETH proxies at new implementation contracts. Four malicious upgrade contracts have already been deployed, although none has been queued through the multisig yet.

If executed, the malicious upgrades could drain roughly 2,500 ETH.

The root cause is unconfirmed. A possible link to the cloud deployment platform Railway was floated based on timing alone, with no conclusive evidence. Holders of swETH and rswETH face the risk of trading against an artificially inflated exchange rate until the keys are secured.