Railway: After a Cloud Breach, a Thief Drained $371,000 From 200+ Crypto Wallets

At 19:36 UTC on 21 October 2026, a program began emptying crypto wallets, one after another. Within hours it made more than 500 transfers out of more than 200 wallets on at least 19 networks and collected about $371,000, according to Taylor Monahan, a well-known crypto security researcher who traced the transfers. Her conclusion was that the keys to those wallets had been stored with Railway, a cloud company that runs other people's software. "They did drain crypto keys that were in Railway," she wrote on X.

Railway had not yet told the public that anything was stolen. At 21:51 UTC it posted "An urgent notice from the Railway team" on X, linking to a security disclosure signed by its chief executive, Jake Cooper. It said "an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." Railway has not confirmed any crypto losses, and none of its statements mention wallets. The link between the breach and the thefts rests on Monahan's analysis of the blockchain records, not on anything Railway has said.

Railway's own count of the exposure is much larger. In a preliminary report released on 23 October, it said "at most 1.85% of all workspaces had some environment variables potentially compromised", which it put at "about 100,000 workspaces". A workspace is roughly one customer account, for a person or a team. Railway, a San Francisco company that Cooper founded in 2020, raised $100 million from investors led by TQ Ventures in January 2026, and says millions of developers use it.

What was stored, and why wallet keys were in it

Railway is a hosting platform. A developer writes a program, such as a website, an app's back office or a trading bot, and instead of buying and running servers, rents space on someone else's computers in a data centre.

Programs need passwords to do their jobs: the login to a database, a key to take card payments through Stripe, a key to use an AI service such as OpenAI's. Developers keep these in environment variables, secret settings a program reads when it starts, so they never sit in the code itself. It is the office version of a spare house key in the manager's desk drawer: convenient, and safe only while nobody gets into the office. Railway stored these settings encrypted. Its report says the attacker found a way to unlock some of them.

Some of those programs handle crypto. A trading bot, a payment service or a game that pays out winnings has to send money by itself, at any hour, with nobody there to type a password. For that it needs the wallet's private key, the one password that moves the money. Whoever has the private key owns the wallet. There is no bank behind it, no fraud desk and no way to cancel it. Developers often store it the same way as every other secret: as an environment variable.

"At least 19 networks" sounds like 19 break-ins, but it is one. Dozens of blockchains copy Ethereum's design, among them Base, Arbitrum and BNB Chain, and one private key controls the same wallet address on all of them, like one key that opens the same numbered box at 19 different banks. Monahan called the thief's tool a sweeper script, a program that takes a list of keys, checks every network for anything of value and empties it. It seemed, she wrote, "not something homegrown for this one op". On Ethereum alone, public records show the thief's address swapping dozens of tokens into ether and digital dollars within hours.

"An issue affecting multiple systems"

Railway's preliminary report sets out how long the attack ran before customers heard about it. Monitoring flagged "abnormal system activity" at 13:58 UTC on 20 October, and by the afternoon Railway had halted builds, the step where customers' new code goes live. At 19:53 it "became aware of a sustained and targeted campaign to attack and breach our services". Between 05:27 and 07:25 UTC on 21 October, the attacker obtained credentials for Railway's CI system, the automated assembly line that builds software, and used them to decrypt files holding further access. By 09:18 Railway had "database evidence of an unauthorized query of encrypted environment variables, of which a subset were decrypted".

At 09:25 UTC, by the report's timeline, Railway warned its suppliers. It sent GitHub, GitLab, Anthropic, OpenAI, OpenRouter, Stripe and others the keys that might be exposed and asked them to cancel them; for some services it handed over every key it held. An ordinary API key works like a bank card: the company that issued it can switch it off.

Customers heard nothing about their secrets for more than ten hours after that. Railway's status page opened a "Railway Platform Outage" at 07:24 and by 09:28 said the dashboard, the API and the command-line tool were unavailable. At 19:30, six minutes before the first wallet was drained, it read: "Earlier today an issue affecting multiple systems led us to pause builds across the platform." Nobody can cancel a private key. The only protection is to move the money to a new wallet, and only the owner can do that, once warned.

©CMZ chart. Data: Railway, Taylor Monahan

Railway's explanation, in its report: "we wanted to ensure the attacker was ejected from our running infrastructure before telling users to roll their credentials, to prevent the credentials from becoming immediately compromised again." It says the attacker lost all access at 03:32 UTC on 22 October.

Who was behind it

Railway has not named the attacker. Its first notice said: "We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers", the companies that sell access to AI models. The preliminary report is more specific: the attack "was attempting to obtain AI provider API keys to perform distillation attacks". Distillation means copying an AI model by feeding it millions of questions and training a cheaper model on the answers, which runs up enormous usage bills unless someone else's key is paying. Railway said the attacker "had access to abliterated models", meaning AI models with their safety limits removed, "and substantial compute resources".

None of that explains a crypto sweeper. Nobody has shown whether the wallet thief is the group that broke into Railway or someone else using keys that leaked from it. Railway says it "engaged external incident response experts and the authorities", without naming an agency. No one has been arrested or charged.

Monahan has followed this trail before. In 2023 she was among the researchers who linked more than $35 million stolen from over 150 people to the 2022 breach of LastPass, the password manager, where many victims had kept their wallet recovery phrases, KrebsOnSecurity reported. On the Railway thefts she asked for help: "Please reply here if you have additional theft addresses, especially on non-EVM chains", meaning networks built differently from Ethereum, such as Bitcoin or Solana. Her $371,000 covers only the Ethereum-style networks she could see.

What Railway told customers to do

The first notice told every customer: "we strongly recommend that you immediately roll all environment variables, including any API keys, stored in Railway, as well as any private registry credentials, and review logs for those services for unusual activity." To roll a key is to cancel it and issue a new one.

From the night of 21 October, Railway changed some keys itself. It reset the keys to every customer storage bucket, its file store, and the GitHub tokens it held, the passes that let it fetch customers' code. "The old values no longer work," its guide of 22 October said, and "Railway performed the reset rather than asking you to, so the exposed credentials stopped working as early as possible." Customers then had to redeploy their programs and reconnect GitHub by hand. The preliminary report extended the advice to "all customers who signed up prior to October 21".

Railway published more than a dozen step-by-step guides, for Amazon Web Services, Google Cloud, GitHub, Anthropic, OpenAI, OpenRouter, Grok, Stripe and four kinds of database. As of 24 October none dealt with crypto wallets. A wallet key cannot be rolled. A new key means a new wallet, and the money has to be moved into it before the thief moves it out.