Railway reported a security incident, and blockchain investigator Taylor Monahan linked it to the theft of approximately $371,000 in cryptocurrency across 19 EVM compatible networks.

Railway indicates that this security incident may have exposed customer environment variables, which contain sensitive credentials and private keys.

• The security incident disclosed by Railway may have exposed customer environment variables, involving sensitive information such as API keys, database passwords, and private repository credentials.
• Blockchain investigator Taylor Monahan has linked this incident to the theft of approximately $371,000 in cryptocurrency, involving more than 500 transactions across at least 19 EVM networks.
• The first known stolen transaction identified by Monahan occurred on October 21 at UTC 19:36, more than two hours before Railway publicly disclosed the security incident.
• Railway has temporarily suspended deployment, and urges all customers to rotate their stored credentials while investigating the scope of impact of this intrusion.

According to the security disclosure released on October 21 by Railway, this cloud deployment platform detected abnormal activity in its system used for storing customer environment variables. These variables may contain sensitive information such as API keys, database passwords, and private repository credentials.

Railway indicates that unauthorized third parties may have accessed encrypted variables and obtained the decrypted content of some of those variables. However, the company stated that the investigation is still ongoing, and the number of affected customers has not yet been determined.

Railway Invasion Alleged to Be Linked to Over 500 Cryptocurrency Transactions

Blockchain security researcher Taylor Monahan stated on October 22 that attackers transferred cryptocurrencies from private keys stored in Railway. It is suspected that the theft involved more than 500 transactions, distributed across over 200 different addresses.

She estimated the loss to be around $371,000, and the affected range covered at least 19 Ethereum virtual machine-compatible blockchains.

The suspected attacker's address identified by Monahan is 0xd9773325282874d18cb83f1fe50f14c39750b2ee, and the first known cryptocurrency theft transaction was recorded on October 21st at UTC at 19:36.

In her judgment, these transactions seem to have been completed using a relatively standard wallet cleaning script, rather than software developed specifically for this event.

Such scripts are used to transfer usable cryptocurrencies from wallets whose private keys have been leaked. The discovery of Monahan indicates that attackers have obtained the credentials necessary to authorize transactions to related addresses.

However, Railway has not yet independently verified the reported losses of cryptocurrency, nor has it confirmed how the attackers obtained the wallet credentials identified by Monahan.

The currently disclosed amount of $371,000 is still just an external estimate. The existing information also does not allow for confirmation as to whether there have been intrusions into other wallets, or whether these identified transactions cover all related losses.

Before the theft of cryptocurrencies was discovered, Railway had already suspended its deployment.

In another post, Monahan questioned the time of disclosure made by Railway and outlined a timeline of service interruptions that began several hours earlier than the first cryptocurrency theft transaction she identified.

According to the timeline she shared, Railway paused construction at 07:24 on October 21 UTC. By 09:28, the issue had affected its API, command-line interface, dashboard, and deployment services.

On that day, users continued to receive service updates, and Railway was also working hard to restore system access.

Monahan sets the time of the first known cryptocurrency theft at 19:36 UTC, about 12 hours after the initial suspension of construction.

UTC At 21:11, Railway, the co-founder and CEO Jake Cooper (who uses the name Postiz on X) was included in the timeline to discuss notifications regarding credential breaches from Stripe and Ant.

Railway Around 21:51, UTC released a security disclosure, more than two hours after Monahan identified the first stolen transaction.

This timeline does not prove when Railway first became aware of the suspected theft of cryptocurrency, nor does it prove whether the earlier service interruptions were directly caused by unauthorized access.

Railway requires customers to replace exposed credentials.

Railway indicates that preliminary investigations suggest that this intrusion may have only affected a portion of customers, but it is recommended that all users of this platform immediately replace their stored environment variables and related credentials.

The company particularly recommends that customers rotate their API keys and private repository credentials, and at the same time, check for any abnormal activities in the service logs.

Railway believes that this incident may be related to a series of attacks targeting platform companies, which are intended to infiltrate the AI inference service providers.

Although the company has not named the suspected attackers or related service providers, it stated that it has notified the upstream services in order to revoke any potentially exposed keys as a preventive measure.

During the investigation period, the deployment feature was temporarily suspended, and customers were unable to release new application versions until the service construction was restored.

As confirmed in the subsequent update on October 22nd, Railway has reset the bucket credentials held by customer accounts and GitHub tokens.

The company stated that the old credentials will no longer be valid. Affected customers need to use the replaced storage credentials to redeploy their services and reconnect to their GitHub accounts.

Voucher leaks have previously caused multiple incidents of cryptocurrency losses.

Vulnerability exposure has led to several cryptocurrency security incidents this year, although the methods of obtaining access rights vary.

In July this year, crypto.news reported that software distributed through a developer package developed by Injective contained malicious code designed to collect private keys and mnemonics.

Security company Socket has discovered that the affected software packages have been downloaded over 300 times, and the malicious updates have also spread to 17 related software packages.

Another incident involving the signature credentials of the Ostium predictor, according to security company Blockaid, resulted in nearly $18 million of USDC being transferred from the trading platform's liquidity vault in July.

In April, Syndicate Labs revealed that a leaked upgrade key allowed attackers to infiltrate their cross-chain bridge and steal SYND tokens as well as user funds.

Railway indicates that once investigators confirm which accounts are affected, the company will contact customers directly via email, and more information will also be released through their security announcements and status pages.