Railway Breach Linked to $371,000 Crypto Drains

Cloud deployment platform Railway disclosed a security breach that may have exposed customer environment variables containing private keys and sensitive credentials. According to on-chain investigator Taylor Monahan, attackers drained approximately $371,000 in cryptocurrency across at least 19 Ethereum Virtual Machine (EVM) compatible networks following the incident.

Timeline and Attack Details

Railway reported detecting unusual activity involving systems that store customer environment variables, such as API keys, database passwords, and private registry credentials. Monahan identified more than 500 unauthorized transactions stemming from over 200 distinct wallet addresses, with the earliest theft recorded at 19:36 UTC on October 21. Railway issued its public disclosure roughly two hours later at 21:51 UTC.

The investigator identified the suspected attacker address as 0xd9773325282874d18cb83f1fe50f14c39750b2ee and noted the activity appeared to be executed through a standard wallet sweeper script. Railway has not independently confirmed the specific cryptocurrency loss figures or established how the attacker obtained the wallet credentials.

Mitigation and Account Resets

Railway temporarily suspended deployments to stop further exposure and advised all users to rotate their stored credentials, API keys, and private registry access. On October 22, the company confirmed it had reset storage bucket credentials and customer GitHub tokens, requiring users to reconnect accounts and redeploy services.

Railway stated the incident may be connected to broader attacks aimed at platform companies providing artificial intelligence inference services. The platform notified upstream service providers to revoke potentially compromised keys as a precautionary measure.

Key facts

• Taylor Monahan linked the breach to roughly $371,000 drained across more than 500 transactions.
• The theft affected over 200 addresses across at least 19 EVM-compatible blockchains.
• Railway detected unauthorized access to customer environment variables storing private keys and API credentials.
• The platform reset GitHub tokens and storage bucket credentials to contain the breach.