US hosting provider Railway said on October 21, 2026 that an unauthorised third party may have accessed the environment variables stored for its customers and decrypted some of them. Those variables hold API keys, database credentials and, at many crypto services, exchange keys and private wallet keys as well. Railway is advising every customer to rotate all of their keys. Security researcher Taylor Monahan already counts roughly $371,000 drained from wallets whose keys sat on Railway; Railway has not confirmed that link. Cryptoticker is a Railway customer too and received the warning overnight.

How the incident unfolded, what Railway’s terms say about liability and why this is a matter for policymakers has been set out in detail by our…