Railway, the cloud hosting platform used by many crypto teams, disclosed on October 21 that an unauthorized party may have accessed customer environment variables and decrypted some of them. Two weeks later, Carlos, growth lead at onchain trading platform Definitive, said an old hot wallet of his was drained and pointed to the Railway breach as the likely link.

About 96 wallets were emptied within roughly 70 minutes, all following the same pattern.

The transfers were signed with the victims' own private keys, which points to leaked keys or seed phrases rather than a smart contract bug. The attacker, operating as noble.base.eth, mainly used Relay to move funds out, and Relay has since blocked the addresses involved.

Total losses across chains have not been tallied yet. The Railway connection remains unconfirmed, but any team that stored wallet keys in hosted environment variables is advised to rotate them immediately.