Railway has disclosed a security breach that blockchain investigator Taylor Monahan linked to approximately $371,000 in cryptocurrency drains across 19 EVM compatible networks.
Summary
- Railway disclosed a security breach that may have exposed customer environment variables containing sensitive credentials and private keys.
- Blockchain investigator Taylor Monahan linked the incident to roughly $371,000 in crypto theft involving more than 500 transactions across at least 19 EVM networks.
- Monahan identified the first known theft transaction at 19:36 UTC on October 21, more than two hours before Railway publicly disclosed the security incident.
- Railway temporarily suspended deployments and urged all customers to rotate their stored credentials while it investigates the extent of the breach.
According to Railway’s October 21 security disclosure, the cloud deployment platform detected unusual activity involving systems used to store customer environment variables, which may contain sensitive information such as API keys, database passwords and private registry credentials.
An unauthorized third party may have accessed encrypted variables and obtained the decrypted contents of some of them, although the company said its investigation was still underway and the number of affected customers had not been established.
Railway breach linked to more than 500 crypto transactions
Blockchain security researcher Taylor Monahan reported on October 22 that attackers had drained cryptocurrency from private keys stored in Railway, with the suspected theft involving more than 500 transactions across over 200 distinct addresses.
Her findings placed the estimated losses at approximately $371,000, with activity spanning at least 19 Ethereum Virtual Machine compatible blockchains.
Monahan identified the suspected attacker address as 0xd9773325282874d18cb83f1fe50f14c39750b2ee and placed the first known cryptocurrency theft transaction at 19:36 UTC on October 21.
According to her assessment, the transactions appeared to have been carried out using a relatively standard wallet sweeper script, rather than software developed specifically for the incident.
Such scripts are designed to transfer available cryptocurrency from wallets whose private keys have been compromised. Monahan’s findings suggest that the attacker had obtained access to credentials capable of authorizing transactions from the affected addresses.
However, Railway has not independently confirmed the reported cryptocurrency losses or established how the attacker obtained the wallet credentials identified by Monahan.
The reported $371,000 figure remains an external estimate, and the available disclosures do not establish whether additional wallets were compromised or whether the identified transactions account for all related losses.
Railway suspended deployments before crypto theft was detected
In a separate post, Monahan questioned the timing of Railway’s public disclosure and outlined a sequence of service disruptions that began several hours before the first cryptocurrency theft transaction she identified.
According to the timeline she shared, Railway paused builds at 07:24 UTC on October 21. By 09:28 UTC, the disruption had affected its API, command line interface, dashboard and deployment services.
Users continued receiving service updates throughout the day while the company worked to restore access to its systems.
Monahan placed the first known cryptocurrency theft at 19:36 UTC, approximately 12 hours after the initial build suspension.
At 21:11 UTC, Railway co-founder and CEO Jake Cooper, who uses the name Postiz on X, was cited in the timeline discussing notifications from Stripe and Ant regarding compromised credentials.
Railway published its security disclosure at approximately 21:51 UTC, more than two hours after the first theft transaction identified by Monahan.
The timeline does not establish when Railway first became aware of the suspected cryptocurrency theft or whether the earlier service disruptions were directly caused by the unauthorized access.
Railway urges customers to replace exposed credentials
Railway said its initial investigation suggested that the breach may have affected only a subset of customers, but recommended that everyone using the platform immediately replace their stored environment variables and associated credentials.
The company specifically advised customers to rotate API keys and private registry credentials while checking service logs for unusual activity.
Railway believes the incident may be connected to a series of attacks against platform companies that were intended to compromise AI inference providers.
Although the company did not identify the suspected attackers or the providers involved, it said it had notified upstream services so they could revoke potentially exposed keys as a precaution.
Deployments were temporarily suspended during the investigation, preventing customers from rolling out new application versions until the build service was restored.
In an October 22 follow-up, Railway confirmed that it had reset storage bucket credentials and GitHub tokens held for customer accounts and services.
The company said the previous credentials would no longer work, requiring affected customers to redeploy services using the replacement storage credentials and reconnect their GitHub accounts.
Compromised credentials have caused previous crypto losses
Credential exposure has been responsible for several cryptocurrency security incidents this year, although the methods used to obtain access have differed.
In July, crypto.news reported on compromised software distributed through an Injective developer package that contained malicious code designed to collect private keys and seed phrases.
Security firm Socket found that the affected package had been downloaded more than 300 times, with the malicious update spreading through 17 related packages.
Another incident involving Ostium’s oracle signing credentials resulted in nearly $18 million in USDC being drained from the trading platform’s liquidity vault in July, according to security firm Blockaid.
In April, Syndicate Labs disclosed that a leaked upgrade key had allowed an attacker to compromise its cross-chain bridge and steal SYND tokens and user funds.
Railway said it would contact customers directly by email once investigators confirmed which accounts had been affected, with further information to be published through its security announcement and status page.
