"The first known cryptocurrency theft transaction is said to have occurred at 7:36 p.m., at least two hours before the incident was officially disclosed," security researcher Taylor Monahan (@tayvano_) reported, tying a concrete theft to a broader service compromise that Railway says affected a subset of its customers.
Railway's disclosure and its immediate remediation steps
Railway disclosed that it observed "anomalous activity" in systems that store customer environment variables. The company said an unauthorized third party may have gained access to encrypted environment variables and, in some instances, obtained the decrypted contents. Railway described the impact as limited to a "subset of users" but did not provide a precise tally.
As part of its immediate response, Railway said it notified upstream providers so those providers could proactively revoke keys to prevent abuse. Railway also rotated all Railway bucket credentials and invalidated Railway API tokens. The company restored builds for Pro and Enterprise workspaces so customers there can apply new credentials, while continuing work to re-enable builds for Hobby, Free, and Trial tiers. "Builds remain available for Pro and Enterprise workspaces," Railway said, while acknowledging that some builds still fail more often than usual and many deployments are queued with longer than usual wait times.
Environment variables, secret exposure, and stolen cryptocurrency keys
The affected data centers on Railway held environment variables — user-defined key-value pairs commonly used to store API keys, database credentials, private registry credentials, or feature flags at the operating system or container level rather than inside source code. Railway urged customers to rotate environment variables, including any API keys stored in Railway, and to rotate private registry credentials as a precaution. The company also asked customers to review logs for unusual activity.
Security researcher Taylor Monahan reported that attackers identified as 0xd9773325282874d18cb83f1fe50f14c39750b2ee were able to drain cryptocurrency wallets whose private keys were stored on Railway. Monahan’s timeline places the first known theft at 7:36 p.m., notably before Railway's public disclosure.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadRailway links the incident to LLMjacking and resource abuse
Railway said the incident is likely part of a chain of attacks designed to target platform companies with the ultimate goal of compromising artificial intelligence (AI) inference providers. The company described attackers’ interest in abusing cloud-hosted compute to run large language models (LLMs) and other AI workloads while leaving the victim to pay for the compute — an approach commonly referred to in the reporting as LLMjacking.
Reporting from multiple security teams shows LLMjacking can take several shapes: unauthorized access to cloud environments to run models, linking external projects to victim billing, and hiding prompt and output data by processing it in attacker-controlled projects. Railway said it had notified upstream providers and taken credential-rotation steps to reduce the ability of attackers to continue such abuse.
Related cases: Wiz's GCP billing abuse and Symantec's autonomous agent findings
Earlier this week, Wiz documented a case in which attackers compromised privileged Google Cloud Platform (GCP) credentials and linked external, attacker-controlled GCP projects to a victim’s internal billing accounts. That attack reportedly used sponsored ads on Google Search as an initial access vector, redirecting users searching for terms like "google cloud" to a fake Google login page via a Google Sites redirect and harvesting both credentials and multi-factor authentication codes.
Wiz researchers Shira Ayal and Andre Maccarone observed that, once inside the victim environment, attackers abused excessive privileges to deepen access, circumvent security controls, and add external Gmail accounts directly into the organization’s billing account. "Because the AI workloads were processed in foreign projects, prompt contents and model outputs remained completely hidden from the victim organization, leaving the nature of the mass AI usage unknown," they wrote.
Complementing that picture, the Symantec Threat Hunter Team described attackers targeting exposed LLM endpoints to power an autonomous cybercrime operation that can scan the internet, exploit vulnerabilities, steal credentials, and mine cryptocurrency without human intervention for up to 100,000 steps. Symantec said the offensive AI agent can operate in a "Skynet mode" and that its captured instructions described a single agent equipped for internet-wide scanning, exploitation of several common web frameworks (including Microsoft Visual Studio Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug), database theft, credential and secret harvesting, and cryptocurrency mining. "The activity is a form of LLMjacking, where attackers steal access to someone else's AI model so that the victim pays for the computing power," the Symantec team reported.
What this means for customers, cloud teams, and AI providers
- Customers: Follow Railway's advisory to rotate environment variables, API keys, and private registry credentials, and review service logs for unusual activity — actions Railway explicitly urged.
- Cloud operations and security teams: Watch for signs that external projects or accounts have been linked to billing, and monitor for unexpected compute spikes or hidden workloads that could indicate resource abuse, as highlighted in the Wiz and Symantec accounts.
- AI inference providers and platform operators: Be mindful that attackers are targeting platform-level secrets to obtain free inference and to hide prompt contents and outputs by shifting workloads to attacker-controlled projects; proactive credential rotation and upstream revocations were the immediate mitigations Railway used.
The Railway incident ties a concrete theft — a flagged cryptocurrency drain — to broader patterns of platform compromise and resource abuse. Railway’s credential rotations and upstream notifications address visible attack paths, but the account remains an example of how secrets stored for convenience (environment variables and registry credentials) can be weaponized into billing and data theft. The precise size of the affected subset remains unspecified, and whether additional thefts will surface as logs and investigations proceed is an open question.
