Railway, a cloud platform used by more than 2 million builders and tens of thousands of companies, halted all deployments on Wednesday after detecting anomalous activity in systems that store customer environment variables. Those variables often hold API keys, database credentials and private registry secrets. In a security disclosure posted on October 21, Railway said an unapproved party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.
Blockchain analytics firm Nansen identified the breach and warned that most of the compromised funds have already reached exchange addresses, raising concerns about offchain security. Railway instructed all users to rotate stored secrets immediately and act as if they have been exposed. Deployments remained paused as of 3 a.m. UTC on October 22, while Railway outlined a staged restart led by Enterprise workspaces, followed by Pro, Hobby, Free and Trial plans.
Mitigation steps include invalidating OAuth sessions, rotating Railway storage bucket credentials automatically and checking service logs for unusual access to Google Cloud, Amazon Web Services, OpenAI, Anthropic, Grok, OpenRouter and Stripe. Railway described the incident as part of a series of attacks targeting platform companies with the goal of compromising AI inference providers. It urged upstream providers to invalidate all keys and estimated that an intruder spent approximately $50 per attack.
Separately, Cryptopolitan reported that eight people disclosed 17,286 DOT as having been transferred through unauthorized access, and that the Fearless Wallet browser extension had sent Polkadot users’ private keys to the attacker’s server. This extends the breach beyond cloud credentials into direct crypto asset losses.
