Railway Preliminary Report Sets 1.85% Workspace Exposure Ceiling

Railway’s Oct. 22 preliminary report put the maximum potential reach at about 100,000 workspaces, or 1.85% of its total, where environment variables may have been exposed. A separate estimate of roughly $371,000 in crypto theft remains unconfirmed by the company.

The workspace figure is an upper bound for possible exposure, not a count of confirmed victims. Railway said it could not determine which specific variables were decrypted. It also said it notified service providers to revoke keys as a precaution, sometimes sharing all keys stored for a provider whether or not investigators knew they had been accessed.

Railway said its incident timeline began Oct. 20 at 9:58 a.m. ET (13:58 UTC) and ended Oct. 21 at 11:32 p.m. ET (Oct. 22, 03:32 UTC), when the company confirmed the attacker no longer had access to its internal systems. The company said existing deployments remained online while it paused new builds and deployments during its response.

Security researcher Taylor Monahan separately estimated that crypto wallets linked to the incident lost about $371,000 across more than 500 transactions involving more than 200 addresses on 19 or more EVM-compatible networks. She placed the first transaction she identified at 3:36 p.m. ET (19:36 UTC) on Oct. 21. Railway has not confirmed the estimate, the alleged exposure of wallet keys or a connection between the transfers and its systems.

The distinction matters because Railway’s disclosure describes access to secrets held in a cloud platform, while the reported crypto loss depends on Monahan’s attribution of blockchain activity. Railway said its forensic evidence indicated the attacker was likely seeking AI and platform API keys for model-distillation attacks. Its report did not specify whether wallet keys were among the variables accessed.

By Oct. 23 at 6:06 p.m. ET (22:06 UTC), Railway said builds, deployments, its API and dashboard were operating normally, though new signups remained paused. The company’s investigation was still underway.