Railway hack: check and replace your crypto API keys - CryptoTicker
US hosting provider Railway reported a security breach on October 21, 2026, where unauthorized third parties accessed customer environment variables containing API keys, with analysts estimating $371,000 drained from affected crypto wallets.
Railway, a US hosting provider, announced on October 21, 2026, that an unauthorized third party may have accessed environment variables stored for its customers and decrypted some of them. These variables contain API keys, database credentials, and for many crypto services, exchange keys and private wallet keys. The company is advising all customers to rotate their keys immediately.
Security researcher Taylor Monahan has tracked approximately $371,000 flowing out from wallets whose keys were stored on Railway, though the company has not confirmed this connection. The outflows began at 19:36 UTC on October 21, more than two hours before Railway publicly warned its customers. Cryptoticker, which is also a Railway customer, received the security notification overnight.
Attack details
The incident began on the morning of October 21 when Railway's status page first reported a platform outage with builds being halted. That evening, founder Jake Cooper disclosed the security incident, revealing anomalous activity on systems storing environment variables. Railway suspects a series of attacks targeting platform companies aimed at compromising AI providers.
Railway has not specified how attackers gained access or which customers were affected. The company has reset credentials for all storage buckets and GitHub connections, and on October 22 invalidated every Railway API token. Builds for enterprise customers resumed by 03:32 UTC and for Pro customers by 06:29 UTC, while smaller plans remained affected at midday.
Related
