Railway breach: crypto keys in env vars drained

SECURITY ALERT

UPDATED 09:57 UTC, 22 Oct. At 09:28 UTC, Railway’s status page said builds were available for Pro and Enterprise workspaces and that it was working on Hobby, then Free and Trial plans; many deployments were still queued. Chief executive Jake Cooper said on X that a full post-mortem would follow, and that Railway would contact customers as it determines who was affected. Railway still had not said whether crypto keys were among the data taken.

The keys were encrypted at rest.

Someone found a way to read them anyway.

Railway, a cloud platform that runs apps for developers, says an unauthorised third party may have reached the environment variables its customers store with it and, in some cases, decrypted them, according to a security disclosure published on Wednesday.

Environment variables are where apps keep their secrets: API keys, database passwords, access tokens.

Some crypto teams keep wallet private keys there too.

Those keys were swept, security researcher Taylor Monahan said on X at 23:56 UTC on Wednesday: about $371,000 so far by her count, from more than 200 addresses on at least 19 EVM networks, sent to 0xd9773325282874d18cb83f1fe50f14c39750b2ee.

Railway has not said that crypto keys were among the data taken.

What Railway says

Railway detected “anomalous activity” on systems that store customer environment variables on Wednesday morning, the company said.

It believes the intrusion is part of a series of attacks on platform companies aimed at compromising AI inference providers, and has told those providers to revoke keys.

It asks every customer, not only those it confirms as affected, to roll all environment variables, including API keys and private registry credentials, and to check logs for unusual activity.

Railway also reset storage-bucket credentials and the GitHub tokens it held for customers, it said in a follow-up guide.

Deployments were paused for all customers. At 03:32 UTC on Thursday, Railway’s status page said builds were back for Enterprise workspaces, with Pro, Hobby, Free and Trial plans to follow in stages. At 04:00 UTC it said its Redeploy feature was still unavailable.

So the secrets can be changed. Can the apps that use them restart yet?

The timeline

21 Oct, morning (UTC): Railway detects the activity, it says.
21 Oct, 19:36 UTC: the first known theft transaction, according to Monahan.
21 Oct, 21:51 UTC: Railway posts “an urgent notice” on X, linking the disclosure.
21 Oct, 22:37 UTC: Railway says it is rotating every storage-bucket credential.
22 Oct, 03:32 UTC: builds restored for Enterprise customers only.

By Monahan’s account, the draining started about two hours before Railway’s public notice.

The address has been busy. Public RPC reads by CryptoWatchDesk at 03:53 UTC show it has sent transactions on Ethereum, Base, Polygon, Arbitrum, BNB Chain, Avalanche and OP Mainnet, and that its native-coin balances on those networks are now close to zero.

That confirms activity, not the size of the losses. The $371,000 figure is Monahan’s, and we have not reconciled it.

Where did the money go after it landed?

Protect yourself

If a wallet private key or seed phrase was ever stored as a Railway environment variable, treat it as exposed. Create a new key on a clean device and move the funds now. On-chain transfers do not need Railway’s builds to be running.
Do it on every network the key touched. Sweepers usually watch all EVM chains at once.
Revoke token approvals granted by the old address, and rotate exchange API keys, RPC keys and any signer or relayer keys that sat alongside it.
Once builds are back on your plan, redeploy with new values, following Railway’s guides.
Ignore anyone offering to “recover” drained funds for a fee.

For the basics, see what a private key is. This week has already seen the Fearless Wallet extension leak.

How many hot wallets sit one config file away from the internet?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.