Swell DAO: swETH and rswETH management keys may have been leaked, and attackers have deployed 4 malicious upgrade contracts

According to security researcher Spreek (@spreekaway), the management keys of swETH and rswETH under Swell DAO are suspected to have been leaked, and attackers are raising the uncollateralized NAV (Net Asset Value) by up to 1% per hour. Currently, four malicious upgrade contracts have been detected and have not yet been queued for execution through multi-signature; if executed, they could steal approximately 2,500 ETH.

Additionally, according to analysis by ADL (@ADLXBT), the management keys control the proxy administrator permissions. Once controlled by attackers, they can direct the swETH/rswETH proxy to malicious implementation contracts, triggering minting or withdrawal functions, thereby inflating the NAV without asset backing. Spreek stated that whether this incident is related to the Railway platform remains speculative; it is currently just a coincidence in timing, with no conclusive evidence available.