Railway breach exposes customer credentials, fueling $371,000 crypto theft

Blockchain researcher Taylor Monahan identified that the attackers utilized standard wallet-sweeping scripts to drain funds after gaining access to sensitive credentials, including API keys and private registry information stored on the platform. The first fraudulent transaction occurred at 19:36 UTC on October 21, more than two hours before the company issued its public security disclosure.

While Railway initiated service suspensions earlier that day, the timeline remains under scrutiny. The platform paused its build services at 07:24 UTC, followed by a total shutdown of its API and dashboard by 09:28 UTC. Railway CEO Jake Cooper later noted that the firm was managing alerts from third-party providers regarding compromised credentials during the same window. The company has since reset all GitHub tokens and storage bucket credentials, urging users to rotate all stored secrets immediately. Railway officials suggest the breach may be part of a broader campaign targeting AI inference providers, though the specific attackers have not been identified.