Railway reported a data leak related to a $371,000 cryptocurrency theft

Railway disclosed a security breach potentially linked to the theft of approximately $371,000 in cryptocurrency across at least 19 EVM-compatible networks. Blockchain researcher Taylor Monahan reported that the incident affected over 500 transactions and more than 200 different addresses, identifying the first known theft transaction at 19:36 UTC on October 21—over two hours before Railway officially announced the issue. The company temporarily suspended deployments and urged clients to change their stored credentials. Reports indicate the breach affected clients' environment variables containing sensitive data such as API keys and database passwords. Railway stated that a third party might have accessed encrypted variables and decrypted some of them, but the number of affected clients is still under investigation.

According to Monahan, the attacker used a standard script to move cryptocurrency from wallets whose private keys were compromised. She pointed out the alleged attacker's address—0xd9773325282874d18cb83f1fe50f14c39750b2ee. Before the theft was identified, Railway suspended builds at 07:24 UTC on October 21; by 09:28 UTC, the outage affected the API, command line, dashboard, and deployment services. At 21:11 UTC, the company's co-founder and CEO Jake Cooper was mentioned in the timeline in the context of notifications about compromised credentials from Stripe and Ant. Monahan also noted the time gap between the suspension of services and the first theft transaction, emphasizing that Railway published its security statement at 21:51 UTC, more than two hours after the first theft was identified. However, the timeline does not establish when Railway first learned of the alleged theft or whether earlier outages were directly caused by unauthorized access.

Railway recommended all users replace their credentials and notified that the initial investigation suggests the leak might have affected only a portion of clients. The company also reported resetting storage bucket credentials and GitHub tokens, requiring users to redeploy services with new credentials and reconnect GitHub accounts. Railway plans to notify clients via email once the investigation confirms which accounts were affected. The reported $371,000 remains an external estimate; Railway has not independently confirmed the losses or determined how the attacker gained access to the credentials.