For many crypto projects, the most sensitive file isn’t a wallet — it’s a settings page. On Wednesday, October 21, 2026, developer platform Railway warned that an unauthorised third party may have accessed customers’ environment variables and decrypted some of them. For crypto teams, those variables often hold exchange API keys, RPC credentials and, worse, private wallet keys.
By the time the warning went out, money was already moving. Security researcher Taylor Monahan counted roughly $371,000 drained from wallets whose keys appear to have been stored on Railway.
Key facts
- On October 21, 2026, Railway said an unauthorised party may have accessed and decrypted some customers’ environment variables, and told every customer to “rotate all of their keys.”
- Taylor Monahan counted about $371,000 drained across more than 500 transactions, from over 200 addresses, on at least 19 blockchains, starting at 19:36 UTC.
- The outflows began about two hours before Railway’s public warning at 21:59 UTC; Railway has not confirmed the link to its incident.
- On October 22 at 04:17 UTC, Railway invalidated all customers’ Railway API tokens and reset credentials for storage buckets and GitHub connections.
- Railway says more than 2 million developers use its platform; it has not said how many customers were affected.
- Founder Jake Cooper said Railway detected anomalous activity on systems storing environment variables.
What happened in the Railway security incident?
Railway detected anomalous activity on the systems that store customers’ environment variables — the configuration values apps read at runtime — and concluded an attacker may have decrypted some of them. It posted the incident on its status page at 21:59 UTC on October 21 and advised customers to revoke and rotate every secret.
In its security disclosure, Railway said it had invalidated all Railway API tokens and reset storage bucket and GitHub connection credentials. Founder Jake Cooper said the company suspects attacks on platform providers aimed at compromising AI companies. The status page tracked builds resuming for enterprise customers at 03:32 UTC on October 22 and for Pro customers at 06:29 UTC.
The crypto side
Monahan’s count, posted on X, put outflows at about $371,000 across more than 500 transactions from over 200 addresses on at least 19 chains. Onchain Lens reported a suspected attacker wallet sending at least $369,300 to the exchange HitBTC and other addresses, while calling the Railway link unconfirmed.
A private key in an environment variable is a hot wallet with extra steps.
Why do crypto apps keep keys in environment variables?
Because it’s convenient. Trading bots, payment backends and automated treasury scripts need to sign transactions without a human, so developers drop the key into the platform’s secret store next to the database password. That works until the secret store itself is breached — and then every service on the platform is exposed at once.
Safer patterns exist, and none are exotic:
- Keep only the operating float in any key a server can use; sweep the rest to cold storage.
- Use exchange API keys with withdrawals disabled and IP allow-lists.
- Prefer dedicated signing services or hardware security modules over raw keys in config.
- Rotate keys on a schedule, not only after incidents.
What should Railway customers do now?
Rotate everything: exchange API keys, wallet keys, RPC and database credentials, AI and payment provider keys. For any wallet whose private key was ever stored as an environment variable on Railway, move funds to a newly generated key rather than just changing the variable. Then check logs for activity between October 21 and the time you rotated.
Railway’s own guides explicitly name OpenRouter, Grok, Anthropic, OpenAI and Stripe among keys to rotate. Teams subject to data protection rules should also check whether a breach notification is required — under GDPR, that deadline is 72 hours.
What this means for merchants and swap users
The Railway case is a reminder that “non-custodial” is a property of a system, not a label. If your backend holds a key that can move funds, your server is a custodian. Merchant setups such as SwapZilla Pay are built so payments settle to the merchant’s own wallet rather than to a hot key on someone else’s server; our guide to accepting crypto non-custodially walks through the trade-offs.
Developers integrating swaps can use the SwapZilla API without storing user funds or signing keys: the user sends from their wallet and receives at their own address. That keeps the blast radius small when — not if — some piece of infrastructure gets breached.
Final thoughts
$371,000 is small next to this year’s headline hacks. The pattern is what matters: one platform breach, hundreds of services, and keys that never should have been there in the first place. The cheapest fix is the one done before the email arrives.