Researchers Flag Swell Rate Manipulation After Railway Key-Drain Warning

An attacker drained about $371,000 from crypto wallets using private keys stored on cloud deployment platform Railway on Oct. 21, according to crypto investigator Tay. Researchers subsequently flagged apparent key abuse at Swell, where transactions raised the reported $ETH exchange rates of its swETH and rswETH tokens.

Railway warned in a security disclosure that an unauthorized third party may have accessed encrypted customer environment variables and obtained the decrypted contents of some of them. Those variables can contain API keys and database credentials. The company urged all users to replace stored credentials, even though its initial analysis suggested only a subset may be affected.

The Swell reports extend the risk from wallet balances to permissions that control protocol accounting. Spreek said the tokens' admin keys appeared compromised and their rates were being raised without matching backing. A connection between Swell's incident and Railway remains unconfirmed.

“They did drain crypto keys that were in Railway,” Tay wrote, reporting more than 500 transactions involving more than 200 distinct addresses across at least 19 Ethereum-compatible chains. The aggregate loss and address and chain counts are Tay's estimates.

Swell's Repricing Permissions

Phylax Systems founder Odysseus described the Swell incident as apparent “BOT-key abuse,” reporting three swETH and two rswETH rate increases of about 1% each. He said the repricing reports inflated reserves described as “transitioning,” and that the reference check retained that input.

Swell's published oracle code restricts snapshot submission to the BOT role. Its reference-rate calculation replaces some submitted balances with onchain values but retains the submitted transitioning balance.

Ethereum records show the same address, `0xB29f1af8720e5fd23aA745559d1DEAAe3D9cda17`, submitted swETH repricing snapshots at 7:02 p.m., 8:04 p.m. and 9:08 p.m. ET on Oct. 21. The second and third receipts report transitioning balances of about 231.71 $ETH and 349.16 $ETH, respectively, while reporting identical execution-layer and validator balances.

Odysseus stressed that the reported “2,513 $ETH held is NOT confirmed loss.” Separately, Spreek said four malicious upgrade contracts had been deployed but had not been queued through the multisig. Those claims do not establish an executed upgrade or a theft of Swell's custody balances. Whether Swell had revoked the affected permissions remained unresolved.

Move Funds and Signing Authority

Operational-security firm Opsek advised crypto teams to treat private keys stored in Railway as compromised. “Migrate, don't rotate,” it wrote. For deployer, relayer and hot wallets, it recommended moving funds and privileged roles—including contract ownership and multisig signing authority—to a new key. For backend signers, it advised pausing or replacing the trusted signer onchain.

Railway recommended immediately replacing environment variables stored on the platform, including API keys and private registry credentials, and reviewing service logs for unusual activity. Its status page said deployments remained paused, preventing applications from picking up replacement credentials through redeployment. Railway was also rotating storage bucket credentials automatically.

Senpi's Jason Goldberg said the AI agent platform runs on Railway but users' funds were unaffected because only users have access to their wallet keys. Existing agents remained online, he said, while deployment of new agents was blocked by the outage.

Railway said it would email affected customers as it confirmed which accounts were involved and publish further updates through its security notice and status page.

*Update, Oct. 21: Added the reports of Swell repricing-permission abuse and Ethereum transaction details.*