Railway hack hits crypto bots and wallets: what to check and replace now

US hosting provider Railway said on October 21, 2026 that an unauthorised third party may have accessed the environment variables stored for its customers and decrypted some of them. Those variables hold API keys, database credentials and, at many crypto services, exchange keys and private wallet keys as well. Railway is advising every customer to rotate all of their keys. Security researcher Taylor Monahan already counts roughly $371,000 drained from wallets whose keys sat on Railway; Railway has not confirmed that link. Cryptoticker is a Railway customer too and received the warning overnight.

How the incident unfolded, what Railway's terms say about liability and why this is a matter for policymakers has been set out in detail by our founder Dennis Weidner, with a screenshot of the customer email: Railway security incident: why liability stops at $100.

Railway hack: the key facts

• October 21, 2026, 21:59 UTC: Railway names the security incident on its status page and advises customers to revoke all environment variables.
• Around $371,000 flowed out from 19:36 UTC onwards according to Taylor Monahan, across more than 500 transactions from over 200 addresses on at least 19 blockchains.
• More than 2 million developers use Railway, by the company's own account. How many customers are affected, it does not say.
• October 22, 04:17 UTC: Railway invalidates all of its customers' Railway API tokens.
• $100 is the liability cap in Railway's terms of use, where the fees of the past twelve months are lower.

Railway hack: what is known so far

Railway is a platform on which developers run applications, databases and background services without managing servers of their own. Crypto projects use platforms like it as well, for trading bots, Telegram bots and small backends. On the morning of October 21 the status page first reported a platform outage and builds were halted. That evening came the security notice from founder Jake Cooper: Railway had detected anomalous activity on the systems that store environment variables, and suspects a series of attacks on platform companies aimed at compromising AI providers (Railway security disclosure).

How the attackers got in, and which customers are affected, Railway has not said so far. The company has itself reset the credentials of all storage buckets and the GitHub connections, and on October 22 invalidated every Railway API token (status page for the incident). Builds for enterprise customers were running again from 03:32 UTC and for Pro customers from 06:29 UTC, while smaller plans were still waiting at midday.

Wallet outflows after the Railway hack: what on-chain analysts report

The first consequences arrived before the warning. Security researcher Taylor Monahan wrote on X overnight that private keys from Railway had apparently been emptied with a widely used sweeper script. She counts roughly $371,000, more than 500 transactions, over 200 affected addresses and at least 19 EVM blockchains, starting on October 21 at 19:36 UTC (Taylor Monahan on X). The service Onchain Lens reports a suspected attacker wallet said to have sent at least $369,300 to the exchange HitBTC and to further addresses, and calls the link to Railway itself unconfirmed.

The two figures come from different counts and cannot be added together. Railway has not confirmed the outflows. The timing stands out: the outflows began a good two hours before Railway warned its customers publicly. If you rotated your keys only after the email, you may already have been too late for an affected wallet.

Why crypto bots are especially exposed in the Railway hack

A trading bot needs access to an exchange, and an arbitrage or sniper bot often needs direct access to a wallet. On platforms such as Railway both typically end up as an environment variable: the exchange API key together with its secret, or the private key of a hot wallet outright. Open that store and no second gap is needed. One private key is enough to move a balance to someone else's address within seconds, on every blockchain where that same address holds funds.

With exchange keys the damage depends on the permissions. A key without withdrawal rights and with an IP restriction is worth little to an attacker; a key with withdrawal rights is an open account. How few permissions a tax tool or a bot really needs is shown in our guide to checking API keys at crypto exchanges. That a single key can survive an account takeover was shown most recently by the case at MEXC.

Add to that the motive Railway names itself: AI keys. Stolen access to language models is resold, and Sysdig security researchers put the cost to a victim at more than $46,000 a day back in 2024 (Sysdig on LLMjacking). If you use AI features in your crypto project, rotate those keys just like the exchange credentials.

Key rotation after the Railway hack: wallets first, then exchange keys

Every key that sat on Railway counts as known until the opposite is proven. Rotation happens at the issuer, not only in Railway. The order follows what moves money:

1. Wallets first. If a private key or a seed phrase sat in a variable, move the balance to a new address with a new key straight away, ideally to a hardware wallet; which devices are suitable is shown in our hardware wallet comparison. Simply renaming the variable protects nothing.
2. Revoke exchange keys. Delete the old API keys at the exchange itself and create new ones, without withdrawal rights and with a fixed IP address. Check the list of permitted withdrawal addresses. Bots are better served by exchanges with clear rules for API permissions, and our comparison of regulated crypto exchanges gives an overview.
3. Read the logs. At every exchange and every service, look for access from unfamiliar IP addresses since October 21, and for orders or withdrawals you do not recognise.
4. Rotate AI and payment keys. Railway's own guides name OpenRouter, Grok, Anthropic, OpenAI and Stripe explicitly. Set spending limits there.
5. Secure databases. New passwords, open connections terminated. If customer data sits in them, the 72-hour deadline for a report to the data protection authority is running.

Liability: Railway pays at most $100

Railway has not announced any compensation. Its terms of use in the version of April 20, 2026 exclude consequential damages, business interruption and data loss, and cap everything else at $100 or the fees of the past twelve months, whichever is higher (Railway Terms of Service). According to archived versions the clause has stood in the contract word for word since 2021. Delaware law applies, and disputes go to arbitration in San Francisco. For a bot wallet that has been emptied, the loss is yours. Why this is a fundamental problem for German companies, and who can be addressed politically, is set out in the analysis by Dennis Weidner.

PHP2Shell: a second critical flaw in the same week

Updates for PHP2Shell appeared on that same October 21: two flaws in PHP rated 9.2 out of 10, through which attackers can run code on web servers without logging in. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (php.net). Germany's BSI advises taking unpatched systems off the network if need be. For crypto users the point is above all this: with services on older PHP stacks, such as small shops or payment pages with a crypto checkout, it pays not to reuse credentials. Further cases we collect in our crypto hacks and security section.

This article is not investment advice. We will update it as soon as Railway names the attack path or the number of those affected.