Bollcoin reported on October 22 that, according to anonymous security analyst Spreek, the admin keys for swETH and rswETH under Swell DAO were suspected to have been compromised. The attacker inflated the tokens' net asset value (NAV) by up to 1% per hour without any asset backing. The attacker also deployed four malicious upgrade contracts that could steal roughly 2,500 ETH if executed; these contracts have not yet entered the execution queue via multisig. Spreek speculated that the incident may be related to the cloud deployment platform Railway, but noted this was only because the timing coincided and there is no conclusive evidence.