# Definitive Growth Lead Says Attack Drained About 96 Wallets By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/51122 Published: 2026-11-07T21:47:38.000Z Updated: 2026-11-07T21:47:38.000Z Section: Technology > Carlos said his own wallet signed the transfer and described the theft as a mnemonic or private-key leak. Relay said it blocked related wallets. Definitive growth lead Carlos said his old hot wallet was drained amid an attack that hit about 96 wallets in 70 minutes, and he suspects a possible link to Railway’s security incident. Carlos said the transfer was signed by his own wallet and characterized the theft as a mnemonic or private-key leak. He said the affected wallets showed a similar pattern and that the attacker favored Relay as an exit route. Relay later said it blocked related wallets. Carlos also associated the broader attack with noble.base.eth, while describing any Railway connection as a suspicion. Railway’s [preliminary report]() said an unauthorized party may have accessed encrypted customer environment variables and may have obtained decrypted contents from some of them. The variables, stored on its deployment platform, may include API keys, database credentials and credentials for private image repositories. The disclosure did not specify whether wallet keys were among the data that may have been accessed. ## Links in this article - [preliminary report](https://www.tokenpost.com/news/technology/39395)