Railway disclosed that an unauthorized third party may have accessed encrypted customer environment variables and obtained some decrypted contents; it paused deployments and urged customers to rotate secrets and review service logs in its October 21 notice.

Railway disclosed that an unauthorized third party may have accessed encrypted customer environment variables and obtained some decrypted contents; it paused deployments and urged customers to rotate secrets and review service logs in its October 21 notice.

Onchain activity supports that crypto was drained: the reported address 0xd977…b2ee received tokens from many addresses and made repeated transfers across Ethereum, Base and Arbitrum. Tayvano_ reported 500+ transactions, 200+ distinct addresses, 19+ EVM chains and about $371,000 stolen, and identified the address as the attacker in her post. An Ethereum transaction shows a sweep involving hundreds of token transfers, while the address’s transfer history records outbound token movements in this transaction.

The evidence therefore supports a crypto drain occurring amid Railway’s incident, but does not independently prove that each drained wallet’s private key was stored on Railway or establish the full reported dollar total. The Railway incident itself may have affected only a subset of customers, and its initial disclosure did not name crypto victims.