Railway hack hits crypto bots and wallets: what to check and replace now

US hosting provider Railway said on October 21, 2026 that an unauthorised third party may have accessed the environment variables stored for its customers and decrypted some of them. Those variables hold API keys, database credentials and, at many crypto services, exchange keys and private wallet keys as well. Railway is advising every customer to rotate all of their keys. Security researcher Taylor Monahan already counts roughly $371,000 drained from wallets whose keys sat on Railway; Railway has not confirmed that link.