# Railway Freezes Deployments, Orders Users to Rotate Keys

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/38112
Published: 2026-10-22T16:58:40.000Z
Updated: 2026-10-22T16:58:40.000Z
Section: Technology

> Some customer environment variables may have been exposed. Railway was restoring deployments by plan tier as it investigated.

Railway halted deployments and told every customer to replace API keys after warning that an unauthorized party may have made some stored customer secrets readable, creating a potential exposure risk for crypto teams using the platform.

Suspicious activity was detected on Oct. 21 in Railway systems that store customer environment variables. Those settings can hold API keys, database credentials and private registry credentials. The company’s initial review indicated that only a limited subset of users may be affected.

Railway advised customers to replace stored variables and review service logs for unusual activity. Railway planned to email users as it identified affected accounts. The party’s identity and the number of affected accounts were not disclosed.

At 12:14 p.m. ET (16:14 UTC) Oct. 22, Pro and Enterprise deployments were running at normal speed, although some builds failed shortly after starting. Railway was still restoring builds for Hobby, Free and Trial plans.

The exposure matters to crypto teams because API keys and other credentials may be stored in those environment variables.