Railway urges credential resets as investigator alleges $371,000 crypto theft
Summary
Railway disclosed that an attacker may have accessed encrypted customer environment variables, which can contain API keys and other credentials. It urged all users to replace stored secrets, revoke exposed credentials and review service logs, cloud audit logs and billing. Railway has not disclosed the cause or number of affected customers. An on-chain investigator alleged about $371,000 in crypto theft across at least 19 EVM chains, but Railway has not confirmed the theft or linked it to the incident. Railway invalidated its own API tokens and temporarily paused deployments; service access was gradually being restored, with delays remaining for some users.
