A security incident at cloud deployment platform Railway has been linked to the theft of roughly $371,000 in cryptocurrency, after an attacker allegedly used exposed private keys to drain wallets across dozens of blockchain networks. Separately, researchers flagged what appears to be unauthorized manipulation of exchange-rate data for Swell protocol's swETH and rswETH tokens, raising unresolved questions about whether the two incidents are connected.
How the Railway Breach Unfolded
According to crypto investigator Tay, the attacker executed more than 500 transactions across over 200 distinct addresses spanning at least 19 Ethereum-compatible chains on Oct. 21. Those figures are Tay's own estimates and have not been independently verified by Railway. In a security disclosure, Railway confirmed that an unauthorized third party may have accessed encrypted customer environment variables and obtained decrypted contents for some of them-data that commonly includes API keys and database credentials. The company said its initial analysis suggests only a subset of users are affected, but it urged all customers to replace stored credentials as a precaution.
Railway's status page indicated that deployments remained paused during the response, which prevents applications from automatically picking up new credentials through redeployment. The company said it is also rotating storage bucket credentials and will notify affected customers by email as its investigation confirms which accounts were involved.
Swell's Token Rates and the Repricing Question
Researchers including Phylax Systems founder Odysseus reported apparent "BOT-key abuse" affecting Swell's oracle system, which governs the exchange rates of its swETH and rswETH liquid staking tokens. He documented three swETH and two rswETH rate increases of roughly 1% each, suggesting inflated reserve figures were submitted and accepted by the protocol's reference-rate calculation. Ethereum transaction records show the same address submitted swETH repricing snapshots three times on Oct. 21, with later submissions reporting growing "transitioning" balances-231.71 ETH and then 349.16 ETH-while execution-layer and validator balances stayed identical.
Odysseus was explicit that the roughly 2,513 ETH referenced in these reports is "NOT confirmed loss." Separately, researcher Spreek noted that four malicious upgrade contracts had been deployed but were not queued through Swell's multisig, meaning no unauthorized upgrade has been executed. Whether Swell has revoked the compromised permissions remains unclear, and no confirmed link between the Swell incident and the Railway breach has been established.
What Affected Teams Are Being Told to Do
Operational-security firm Opsek recommended that any team storing private keys on Railway treat those keys as compromised outright. Its guidance: "Migrate, don't rotate." For deployer, relayer and hot wallets, that means moving funds and transferring privileged roles-including contract ownership and multisig signing authority-to newly generated keys rather than simply swapping credentials in place. For backend signing systems, Opsek advised pausing operations or replacing the trusted signer at the smart-contract level.
Not every Railway-hosted service reported impact. Jason Goldberg of AI agent platform Senpi said the company's infrastructure runs on Railway, but user funds were unaffected because private wallet keys remain exclusively in users' control. Existing agents stayed online during the incident, though deployment of new agents was blocked while Railway's pause remained in effect.