Railway: customer secrets exposed; ≈$370K swept from crypto keys stored there
Update
Railway: secrets read in up to about 100,000 workspaces
85% of workspaces, about 100,000. The hunt was mainly for AI-provider API keys. User accounts were not accessed. Access to source code has not been ruled out.
Railway still gives no crypto loss figure. The earlier ≈$370K sweep from keys stored there stands.
Update
cc0 Company says worker wallets were hit
22 Oct: cc0 Company says its worker wallets were impacted after the Railway incident. It rotated keys and says user funds were not at risk. No amount was given.
Railway's own disclosure is unchanged: still no root cause and no customer count.
21-22 Oct 2026: Railway says an unauthorized party may have accessed encrypted environment variables and, for some of them, the decrypted contents. Deployments were paused.
Investigator Tay traced about $370K swept from crypto keys kept on the platform, in 500+ transactions across 19+ EVM chains, starting about two hours before the public notice. Railway has not stated a crypto loss figure.
Several projects said they rotated secrets. Research snapshot from Railway and Tay.
369 take
A private key in a host variable cannot be rotated in place. If a wallet key or deployer key lived in Railway, move the funds to a fresh wallet and move contract roles.
Rotating the variable is not enough.
Sources