# Railway Urges Credential Resets as Tayvano Alleges $371,000 Crypto Theft

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/39027
Published: 2026-10-23T13:56:13.000Z
Updated: 2026-10-23T13:56:13.000Z
Section: Technology

> Tayvano’s estimate covers more than 500 transactions across at least 19 Ethereum Virtual Machine (EVM) chains. Railway has not confirmed the theft or a connection to its exposure incident.

Railway urged users to rotate stored credentials as investigator Tayvano estimated about $371,000 in crypto theft involving keys kept on the platform; Railway has not confirmed the theft or a connection to its security incident.

Railway disclosed Oct. 21 that an unauthorized party may have accessed encrypted customer environment variables and obtained some decrypted contents. The variables could include API keys, database credentials and private registry credentials. Railway’s initial analysis suggested the exposure might affect a subset of users, but it urged everyone to rotate stored variables and credentials and review service logs.

Tayvano estimated the alleged theft involved more than 500 transactions across more than 200 addresses and at least 19 EVM chains. Tayvano placed the first known theft transaction at 3:36 p.m. ET (19:36 UTC) Oct. 21.

Railway invalidated all API tokens at 12:17 a.m. ET (04:17 UTC) Oct. 22 and told users to create replacements. At 5:34 a.m. ET (09:34 UTC) Friday, the company said builds and deployments across workspace tiers were running normally. Railway has said it believes the incident may be part of attacks targeting platform companies to reach AI inference providers. It expected to publish a preliminary incident report around midday ET Friday.