Developer Links $370,000 Theft to Railway Secrets Exposure

Crypto developer ethereumdegen.eth has linked roughly $370,000 in alleged thefts to exposed secrets on Railway, the cloud application platform that disclosed a security incident on Oct. 21.

“Yeah someone stole $370k from env vars on railway and prob much more as far as we believe,” the developer wrote on X late Wednesday. The post did not identify a victim or say the funds belonged to the developer.

In a separate post, crypto incident responder @tayvano_ wrote, “They did drain crypto keys that were in Railway.” The investigator estimated about $371,000 across at least 19 Ethereum-compatible chains and identified `0xd9773325282874d18cb83f1fe50f14c39750b2ee` as an attacker address.

An Arbiscan transaction record shows that address received 261,538.49 USD₮0 tokens on Arbitrum at 5:13 p.m. ET on Oct. 21. The record establishes the transfer, not the sender’s identity or whether Railway’s exposure caused it. The Defiant has not independently established the total alleged loss.

Railway’s security disclosure and incident updates had not confirmed cryptocurrency thefts or provided a count of compromised accounts. Its initial analysis suggested the impact might be limited to a subset of users.

Railway customer success engineer Noah Dunnagan wrote on X that “we have reason to believe the attack only took advantage of AI inference tokens,” while still recommending that users rotate all their tokens. Railway’s disclosure said it believed the incident was part of attacks aimed at compromising AI inference providers.

Enterprise Builds Return

As The Defiant previously reported, Railway urged all customers to rotate stored secrets. The company said an unauthorized third party may have accessed encrypted environment variables and obtained some decrypted contents, potentially exposing API keys and database or registry credentials. It recommended replacing all stored environment variables and private registry credentials and reviewing service logs for unusual activity.

Those variables supply applications with configuration and secrets during builds and while services run, according to Railway’s documentation. Changes must be deployed to take effect. The deployment pause therefore prevented customers from applying replacement credentials to their hosted applications.

In an 11:32 p.m. ET status update on Oct. 21, Railway said Enterprise builds were available again, allowing those customers to redeploy with new credentials. Pro, Hobby, then Free and Trial plans would follow in stages. Railway said it would email affected customers directly as it confirms which accounts were compromised.