Railway hack: $386k swept from 255 wallets, $302k cashed out into HitBTC

On October 21, 2026, Railway warned its customers that an attacker had read their environment variables, some of them decrypted. That evening, the private keys some projects kept there were used to empty their wallets. About $386,000 was swept from 255 wallets on 22 EVM chains, all into one address: 0xd977…b2ee.

We traced where every dollar went. $302,000 was cashed out into HitBTC, in three deposits. About $83,000 hasn't moved, and $80,000 of it is USDC that Circle can still freeze. No mixer was used.

Everything below links back to its transactions: see the Explorer board and the case report. We started from the attacker address @tayvano_ found.

What happened

Railway is a cloud platform: apps run there with their secrets in environment variables. Railway says it detected unusual activity on the systems that store them, paused builds and deployments, and told every customer to rotate all of their variables (Railway's disclosure).

Some projects kept wallet private keys in those variables. With the key, the attacker doesn't need to trick anyone: they sign transfers as the owner. A sweeper script did it chain by chain, wallet by wallet.

Timeline (UTC)

• Oct 21, 07:24. Railway's builds are paused, as reported.
• 19:36. The first wallet is swept into 0xd977…b2ee.
• 22:00 to 23:00. The bulk of it: 446 transfers in one hour on Ethereum, Base, Arbitrum and BNB Chain alone.
• 23:53 and 23:57. 265,190 USDT to two HitBTC deposit addresses on Arbitrum.
• 23:54 to 00:00. 1,498 USDT to a HitBTC deposit address on Ethereum; 55,047 USDC and 14.34 ETH to two new wallets.
• Oct 22, 01:35. HitBTC sweeps the two Arbitrum deposit addresses into its own wallets.
• 02:21 to 02:43. The attacker is still moving: Ink, Celo and MegaETH, then the 14.34 ETH straight into HitBTC.

About twelve hours passed between Railway pausing builds and the first theft. Keys that were rotated, and wallets that were emptied, in that window were safe.

Who was hit

255 wallets sent 574 transfers to the attacker, on 22 chains. Almost all of the value was on Ethereum, Base, Arbitrum and BNB Chain; Polygon, Celo, HyperEVM, Optimism, Avalanche and 13 more add about $28,000. Many wallets were hit on several chains at once: the same private key opens the same address on every EVM chain.

• One wallet lost 263,169 USDT on Arbitrum, about 68% of the total. With 31,486 transactions there, it is a service's operating wallet, not a person's.
• Another lost 34,433 USDC, 935 USDT and 5.4 ETH on Ethereum and Base.
• A third lost about $23,700 on Polygon, mostly in pUSD, Polymarket's dollar.
• The rest are small: gas balances and long-tail tokens. Millions of meme tokens were swept but were worth almost nothing: 4.3 million NATIVE on Base sold for $2.43.

Where the money went

$302,000 into HitBTC

• 265,190 USDT on Arbitrum. 225,146 USDT to 0xf006…6e8e (tx) and 40,043.78 USDT to 0xffc8…f1cd (tx). Both are HitBTC deposit addresses: HitBTC topped them up with gas and swept them into its collector, then its hot wallet.
• 14.34 ETH on Ethereum. Parked in 0x7842…e065 at midnight, then sent at 02:43 straight to HitBTC's hot wallet (tx), not through a deposit address.
• 1,497.98 USDT on Ethereum to 0x1cad…07da (tx), a HitBTC deposit address since 2020.

Inside an exchange the money is pooled with everyone else's, so on-chain the trail stops there. None of HitBTC's withdrawals since went to an address we know as the attacker's. But HitBTC knows the account behind these three deposits, where it withdrew to, and can freeze what's left.

$83,000 still parked

• 55,046.92 USDC in 0xaaa9…901c on Ethereum (tx), a new wallet that has never sent anything.
• 15,186.71 USDC in 0xa3cc…c0a3 on Polygon (tx), after a bridge to Ethereum was refunded.
• 9,372.18 USDC in the attacker's own address on Ethereum, bridged in from other chains.
• 998.96 USDT on Celo, 0.71 ETH on Arbitrum, 0.07 ETH on Optimism, and small balances on a dozen chains.

Circle can freeze all of that USDC, and Tether the USDT on Celo.

How it was moved

The swept tokens were sold through a swap router that keeps 0.85% of each swap. The loot on the other chains was brought back to the same address on Ethereum through bridges: Across from Base (tx), Meson, Mayan from Polygon, HiFiSwap, Relay and Circle's CCTP. Nothing went into Tornado Cash or any other privacy pool.

Address poisoning

Other scammers are already poisoning the attacker's own history. Fake USDC and USDT tokens show it "sending" the same amounts to look-alike addresses: 55,046.92 fake USDC to 0xaaa2…901c, a copy of the real 0xaaa9…901c, three times. No real money moved there. If you need one of these addresses, copy it from the case report, never from a wallet's history.

What to do

• If you used Railway: move funds out of any wallet whose private key was in an environment variable, to a new key, even if it hasn't been touched.
• If you were hit: report it to HitBTC with the deposit addresses and transaction hashes above, and file a police report. The case report has every address and transaction in one place.
• Got drained another way? Paste your wallet on Iris to see where your money went.

Limits

Some chains' public RPCs didn't answer, so small amounts there may be missing. About $1,200 sent through HiFiSwap from Polygon couldn't be followed to its other side. The attacker was still active on October 22, so balances may change. Dollar values use ETH at about $2,450 to $2,480 at the time.