Railway PaaS Confirms Intruder Access to Decrypted Environment Variables, Crypto Wallets Drained Hours Before Disclosure

Railway identified unauthorized access to encrypted environment variables used for API keys, database credentials, and private registry tokens. Investigation showed decryption succeeded in multiple cases. The company rotated all bucket credentials and invalidated API tokens while restoring builds for Pro and Enterprise tiers. Customers were instructed to rotate stored secrets and review logs.

Transaction records tied to address 0xd9773325282874d18cb83f1fe50f14c39750b2ee show wallet drains beginning at least two hours before public notification. Taylor Monahan documented the sequence. Railway stated the activity aligns with broader campaigns targeting platform providers to reach AI inference endpoints rather than direct data exfiltration.

The incident matches the LLMjacking pattern documented by Wiz on GCP, where compromised credentials enabled external billing linkage for hidden AI workloads. Symantec telemetry shows similar autonomous operations scanning for exposed LLM endpoints and chaining credential reuse across providers. Railway's limited disclosure on affected user count and lack of pre-incident monitoring indicators leaves downstream providers exposed.

Upstream key revocations have begun, yet Hobby and Free tier builds remain degraded. Expect further PaaS disclosures within 14 days if the targeting pattern holds, with emphasis on inference credential chains rather than direct monetary theft.