Wallets whose keys sat with app-hosting company Railway were drained of an estimated $371,000 this week. Railway says an unauthorized party may have read and decrypted some of the "environment variables" customers store on its platform between October 20 and 22. That's where developers keep passwords, API keys and, sometimes, wallet keys.

Key facts

  • Who: Railway, a US cloud platform that hosts apps and bots for developers
  • What: Possible access to customers' stored secrets (environment variables), some decrypted; Railway estimates at most 1.85% of workspaces were affected
  • When: October 20 to 22, 2026; disclosed October 22
  • How much: About $371,000 drained from 200+ addresses on at least 19 chains, per researcher Taylor Monahan; Railway hasn't confirmed the link
  • Source: Railway's security disclosure, reported by crypto.news and Analytics Insight

What happened

Railway is a hosting service that developers use to run websites, apps and trading bots. Its preliminary report says the attacker seemed to be after AI-service keys. But anything else in the same settings could be read too, including exchange API keys and wallet private keys. Railway rotated its own credentials, invalidated API tokens, paused new deployments and told customers to change every secret they had stored there. It says user accounts weren't accessed.

Security researcher Taylor Monahan counted more than 500 draining transactions from over 200 addresses on at least 19 networks. She says they began at least two hours before Railway went public. Railway hasn't confirmed that those wallets were its customers'. The total may still rise.

Who should worry

  • If you've never deployed an app: you're not directly exposed. But a trading bot, signal service or tool you pay for might run on Railway. If it holds an API key to your exchange account, ask the provider whether it used Railway, and revoke the key either way.
  • If you run anything on Railway: treat every stored secret as known to someone else. Making a new key isn't enough. Delete the old one at the exchange or service so it stops working.
  • If a wallet's private key was ever in those settings: move the funds to a brand-new wallet. A key can't be "changed". Once it's out, the wallet is burned.

The lesson that outlasts Railway

An exchange API key should never have withdrawal rights. Where the exchange allows it, lock it to your server's IP address, so a stolen key can trade but can't send coins away. A hot wallet a bot controls should hold only what the bot needs that week. Our guide to hot and cold wallets explains the split. Expect "Railway security team" emails asking you to "re-verify secrets" too. Run them through our 2-minute scam check.

An exchange API key made for a bot two years ago still works today unless someone deleted it. Most exchanges list every key on one page, with the date it was made.

Sources: crypto.news, Analytics Insight, pwn.watch: Railway disclosure summary, CryptoTicker.