Railway's Secret Store Was Read and 200 Addresses Were Swept. API Keys Rotate. Private Keys Can Only Move

What Happened

Railway is a San Francisco platform-as-a-service that runs applications and keeps each application's configuration, secrets included, as environment variables in a store the platform encrypts; about 2 million developers use it, per VentureBeat's January report on its $100 million Series B.

On Wednesday, October 21, the company posted a security disclosure under chief executive Jake Cooper's name. It said Railway had detected 'anomalous activity involving systems that store customer environment variables' earlier that morning, and that its investigation to date indicated 'an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.'

Railway said it believed the intrusion was 'part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers' and that it had asked those providers to revoke keys proactively. It paused all deployments, said the impact 'may be limited to a subset of users,' and told all users to rotate every stored variable anyway.

Status-page updates relayed by the security press add that Railway invalidated every API token, rotated its storage-bucket credentials, and restored builds in stages: Pro and Enterprise workspaces at normal speed by 16:14 UTC on Thursday, October 22, with Hobby, Free, and Trial still paused.

The company has not said how the attacker got in or how many accounts were read.

The drains were on-chain before the disclosure had circulated. The security researcher Taylor Monahan wrote in a post on X that attackers 'did drain crypto keys that were in Railway' and tied the thefts to one address, 0xd9773325282874d18cb83f1fe50f14c39750b2ee, with a first known theft at 19:36 UTC that day, then more than 500 transactions from more than 200 distinct addresses across at least 19 EVM chains, about $371,000 in total, run by 'an okay sweeper script,' not custom tooling.

Railway has not confirmed the figure, and crypto.news and Analytics Insight, which carried it, note that nobody has established how the wallet keys were obtained. The collateral ran wider: Nevo David, founder of the social-scheduling service Postiz, which runs on Railway, posted that he was shutting it down for all customers after Anthropic and Stripe each emailed that its keys were compromised.

And at the liquid-staking protocol Swell, the researcher Spreek reported on Thursday that an actor had taken control of operational hot keys, including the bot that sets the swETH and rswETH exchange rates, from about 14:25 UTC on Wednesday, 5 hours before Monahan's first Railway theft.

Spreek called the overlap a temporal coincidence with no evidence behind it, and Swell has not named a cause.

Rotate is the right word for a key someone issued you. For the key that is the account, the only verb is move, and the clock started at 19:36 UTC on Wednesday.

The Campaign Wanted Keys That Rotate. It Found Some That Cannot

Read Railway's attribution against the month's other disclosures and the target is consistent. Fireworks AI, an inference provider, said in a bulletin dated October 9 that an unauthorized party had used internal Fireworks credentials to read environment variables in evaluation jobs for a limited number of customer accounts, capturing API keys and tokens stored there.

OpenCode said a breach of its hosted Console exposed the saved OpenAI and Anthropic keys of 1.4% of Console users in what it called a large-scale distillation attack; some users reported unauthorized bills above $1,700 overnight, per BleepingComputer. On the same Wednesday as Railway's disclosure, a malicious LiteLLM release, version 1.

107.0, sat on PyPI for under 2 hours and on the official Docker tags a little longer, carrying a credential stealer and a remote code loader: the project's second compromise this year, after the March attack this site covered on April 13. A stolen inference key is metered compute, resold or used to distill a model until the provider revokes it, and Railway pulled that lever for its customers by notifying the upstream providers.

A wallet key stored in the same variable table has no issuer to call. Whatever the attacker was looking for, the sweeper script says what it also found, and the first transaction at 19:36 UTC says how long it took to use it.

Swell is the instructive case because the key was taken and the money, as of this writing, was not. By Spreek's account, the stolen oracle-bot key could only raise the swETH and rswETH exchange rates by the maximum the contract allows, 1% per hour, and the published swETH source backs that: admin-set minimums on the reprice interval and maximums on the change per reprice bound the bot role.

By Thursday swETH stood about 3% above its last honest rate of 1.133254 ETH and rswETH about 2% above 1.082464 ETH, 3 and 2 discrete jumps by Phylax founder Odysseus's count. A 1%-an-hour ceiling on a rate that lending markets and redemptions read buys defenders time to notice. The 4 malicious upgrade contracts are the larger threat: analysis cited by Crypto Briefing says the management key controls proxy-admin rights, so pointing the proxies at those implementations could sweep about 2,513 ETH.

They had not entered the multisig execution queue; Swell said it had taken precautionary measures, and that no ETH had been withdrawn from or deposited into the contracts. The figures are preliminary; the design lesson does not depend on them. A hot key with a rate ceiling and an upgrade path that has to wait in a queue behind other signers turned a compromise into an alarm.

A hot key with the whole balance behind it, the kind a sweeper script is built for, turned 200 addresses into 1.

What This Means for You

If a signing key has ever been an environment variable on a hosted platform, treat it as published. That covers an EVM private key behind a bot or relayer, a Bitcoin WIF or extended private key behind a payment server, a Lightning node's seed on a cloud host, and a Nostr key. None of those rotate; Opsek's phrase, carried by crypto.

news, is 'migrate, don't rotate.' Generate the replacement on a machine that was never on the platform, a hardware wallet or an air-gapped signer where you can, move the funds, then move the roles: contract ownership, multisig signer slots, deployer and relayer authority, any on-chain allowlist that names the old address.

Credentials that do rotate, an admin macaroon or an exchange API key with withdrawal rights, get revoked at the source, not in the dashboard that stored them. Railway's pause is the reminder that you may not be able to redeploy to pick up a new secret. You can always sign a transfer from somewhere else, and the move should not wait for the build queue.

The second step is to stop the next copy of the key from existing. A hosted service should hold a credential that expires, not the key that is the account. For Core Lightning and LDK nodes that means a remote signer such as VLS, with the funds under a key the cloud never sees; for EVM infrastructure it means a signer backed by a cloud key-management service or a hardware module that the application can ask for signatures but never export; for anything that must stay hot, it means a ceiling and a delay, the 2 things that held at Swell.

Give the hot key a spending cap and a withdrawal allowlist, put upgrades and large moves behind a multi-sig with a timelock, and keep the signers on devices that are not the host. The contrary view deserves its due: environment variables are how nearly every deployment guide says to store a key, nothing published shows Railway's encryption was broken rather than its decrypting systems read, the loss is small against 2 million developers, and the attackers, by the platform's account, wanted inference credits.

All of that is true, and none of it changes the category. A key the platform can decrypt for your process is a key the platform's intruder can decrypt for theirs.

This is where self-custody stops. Holding your own keys answers the exchange, the custodian, and the issuer's freeze list. It has nothing to say about the landlord of the machine that reads the key. A key in a rented secret store is custodied by the store's operator, without the name or the terms of service.

The private keys on hardware you control are yours. The ones pasted into a dashboard were, in every way that mattered at 19:36 UTC on Wednesday, the platform's. Key control is a property of where the key lives, not of who generated it.

What to Watch

Railway's root-cause report is the first checkpoint: how the intruder reached the decrypting systems, how many accounts were read, and whether the affected-customer emails name wallet keys among the variables. The attacker address Monahan named will show whether the tally grows past $371,000.

At Swell, the 4 deployed-but-unexecuted upgrades are the number to refresh: if the management key is rotated and the proxies' admin rights move before anything enters the execution queue, the design held, and a post-mortem naming the key's origin would settle the Railway question Spreek left open.

Any further platform disclosure naming AI inference providers as the target would confirm the campaign Railway describes, and any wallet drains that follow it would confirm what else sits in those tables.