Railway disclosed a security breach on October 21 after spotting unusual activity in systems storing customer environment variables. Blockchain investigator Taylor Monahan linked the incident to approximately USD 371,000 in suspected cryptocurrency theft across at least 19 Ethereum-compatible networks.
She identified more than 500 transactions involving over 200 addresses. Railway has not confirmed those losses or determined how many customers the breach affected. The cloud deployment company suspended deployments and told customers to replace credentials during its investigation.
Researcher Traces Suspected Drains to Compromised Keys
Railway said an unauthorized third party may have accessed encrypted environment variables and obtained decrypted contents from some records. These settings can hold API keys, database passwords and private registry credentials. Initial findings suggested that only some customers faced exposure.
On October 22, Monahan reported that attackers used private keys stored on the Railway to drain digital assets. She estimated losses at roughly USD 371,000 across at least 19 Ethereum Virtual Machine networks.
Monahan identified 0xd9773325282874d18cb83f1fe50f14c39750b2ee as a suspected attacker address. She traced the first known theft transaction to 19:36 UTC on October 21. The activity resembled a standard wallet sweeper script, which moves funds from wallets with compromised private keys.
Railway has not verified that assessment or confirmed whether other wallets suffered losses. How many wallets did attackers compromise? Neither Railway's disclosure nor Monahan's findings established a final figure.
Disclosure Followed Hours of Service Disruptions
Monahan also shared a timeline of the Railway's service problems and subsequent security announcement. According to that timeline, Railway paused builds at 07:24 UTC on October 21. At 09:28 UTC, disruptions extended to its API, command line interface, dashboard and deployment services.
The railway posted updates as it worked on recovery. At 21:11 UTC, a timeline entry cited co-founder and CEO Jake Cooper discussing notifications from Stripe and Ant about compromised credentials.
The company published its security disclosure at approximately 21:51 UTC. That came more than two hours after the first theft transaction Monahan identified. Still, the timeline did not show when Railway learned about the suspected crypto drains or link the earlier outages to unauthorized access.
Railway said the incident might connect to a broader series of attacks against platform companies targeting AI inference providers. It did not identify the suspected attackers or the affected providers. It notified upstream services so they could revoke potentially exposed keys.
Read More: Bitcoin Outflows, XRPL Adds Nearly 490,000 Accounts, Trezor Data Breach
Railway Resets Tokens and Urges Credential Rotation
Railway urged every customer to rotate environment variables and related credentials, despite signs that only some accounts faced exposure. It specifically advised replacing API keys and private registry credentials and reviewing service logs for suspicious activity.
On October 22, Railway said it had reset storage bucket credentials and GitHub tokens for customer accounts and services. Previous credentials would no longer work. Customers therefore needed to redeploy services using replacement storage credentials and reconnect their GitHub accounts.
The company temporarily blocked new deployments while it investigated and later restored its build service. It said it would email customers once investigators confirmed the accounts involved and publish further updates through its security announcement and status page.
Other cryptocurrency incidents this year have also involved exposed credentials. In July, researchers reported malicious code in an Injective developer package that sought private keys and seed phrases. Security firm Socket said downloads exceeded 300 and the update reached 17 related packages.
Also in July, security firm Blockaid attributed nearly USD 18 million in USDC losses at Ostium to compromised oracle signing credentials. In April, Syndicate Labs reported that a leaked upgrade key enabled an attacker to breach its bridge and steal tokens and user funds.
Conclusion
Railway's investigation has yet to identify every affected customer or confirm the crypto losses Monahan reported. Her findings link the security incident to an estimated USD 371,000 in suspected drains across 19 networks. Railway has instructed customers to rotate credentials, review logs and follow its security updates.