Railway key leak: $386k swept from 255 wallets, $302k cashed out into HitBTC

On Oct 21, 2026 Railway disclosed that an attacker had read customer environment variables, some of them decrypted. Projects that kept wallet private keys there were emptied that evening into one address, 0xd977…b2ee, on 22 EVM chains. We traced where the money went: $302k into HitBTC, in three deposits on Arbitrum and Ethereum, and $83k still parked in wallets that haven't moved, $80k of it in USDC that Circle can freeze.

Timeline (UTC)

• Oct 21, morning: Railway detects unusual access to the systems that store environment variables, pauses builds (07:24, as reported) and tells customers to rotate every variable.

• 19:36: the first wallet is swept into 0xd977…b2ee.

• 22:00 to 23:00: the bulk of it, 446 transfers in one hour on Ethereum, Base, Arbitrum and BNB Chain alone.

• 23:53 and 23:57: 265,190 USDT to two HitBTC deposit addresses on Arbitrum.

• 23:54 to 00:00: 1,498 USDT to a HitBTC deposit address on Ethereum, 55,047 USDC and 14.34 ETH to two new wallets.

• Oct 22, 01:35: HitBTC sweeps the two Arbitrum deposit addresses into its collector.

• Oct 22, 02:21 to 02:43: the attacker is still moving: Ink, Celo and MegaETH, then the 14.34 ETH straight into HitBTC's hot wallet.

About twelve hours passed between Railway pausing builds and the first theft. Keys that were rotated, and wallets that were emptied, in that window were safe.

Who was hit

255 wallets sent 574 transfers to the sweeper on 22 EVM chains. Almost all of the value was on Ethereum, Base, Arbitrum and BNB Chain; Polygon, Celo, HyperEVM, Optimism, Avalanche and 13 more add about $28k. Many were hit on several chains: the same key opens the same address everywhere.

• 0xf517…52fb: 263,169 USDT on Arbitrum, about 68% of the total. With 31,486 transactions there, it is a service's operating wallet, not a person's.

• 0x7c28…f77c: 34,433 USDC, 935 USDT and 5.4 ETH on Ethereum and Base.

• 0x661f…098a: about $23.7k, mostly in pUSD (Polymarket's dollar), on Polygon.

• The rest are small: gas balances and long-tail tokens. Millions of meme tokens were swept but fetched little; 4.3M NATIVE on Base sold for $2.43.

Where the money went

$302k into HitBTC

• 265,190 USDT on Arbitrum: 225,146 to 0xf006…6e8e (0xefb69eae…) and 40,043.78 to 0xffc8…f1cd (0x35fc170a…). Both are HitBTC deposit addresses: HitBTC topped them up with gas and swept them at 01:35 into its collector 0xcc8a…4c2f, then its hot wallet 0x9390…e49e.

• 14.34 ETH on Ethereum: parked in 0x7842…e065 at 00:00 (0xdee103b5…), then sent at 02:43 straight to HitBTC's hot wallet 0x8078…ee1a (0x9ac53182…), not through a deposit address.

• 1,497.98 USDT on Ethereum to 0x1cad…07da (0x78a15045…), a HitBTC deposit address since 2020, swept into the same hot wallet at 02:05.

Inside HitBTC the money is pooled with everyone else's, so its withdrawals can't be tied to the attacker on-chain: none went back to an address we know as theirs, and the big ones are HitBTC moving USDT to its own Binance account, as it did before the theft. HitBTC knows the account behind these three deposits and can freeze it.

$83k still parked

• 55,046.92 USDC in 0xaaa9…901c on Ethereum (0xcc9e6c33…), a new wallet that has never sent anything.

• 15,186.71 USDC on Polygon in 0xa3cc…c0a3 (0x519dbd4f…), after a bridge to Ethereum was refunded.

• 9,372.18 USDC in the sweeper itself on Ethereum, bridged in from other chains.

• 998.96 USDT on Celo in 0x11af…e434, 0.71 ETH on Arbitrum in 0x07e2…76f5 (0x597f13e9…), 0.07 ETH on Optimism in 0x2799…6be5, and small balances on a dozen chains.

How the rest was moved

• Tokens were sold through a swap router (0xb444…dda5) that keeps 0.85% of each swap; its fee wallets are not the attacker's.

• Loot on other chains came back to the sweeper on Ethereum: 2.54 ETH through Across from Base (0x184ef20f…), 2,734 USDC through Meson, 9,201 USDC through Mayan from Polygon, and HiFiSwap, Relay and Circle's CCTP for the rest.

• No mixer: nothing went into Tornado Cash or any privacy pool.

Leads

• On Celo, the gas for the attacker's last moves came from 0x89c1…bedc, funded a minute earlier by 0x5e9b…c15e, a large unlabeled hot wallet (11.3M CELO, 22,500 transactions). If it is an exchange, that withdrawal names an account.

• On Avalanche, 7.31 AVAX went to a deposit address emptied into 0x28f0…1ff1, an unlabeled service.

Address poisoning

Other scammers are poisoning the attacker's own history: fake USDC and USDT tokens show it "sending" the same amounts to look-alike addresses (for example 55,046.92 fake USDC to 0xaaa2…901c, a copy of the real 0xaaa9…901c, three times). No real money moved there, and they aren't on the board. Copy addresses from this report, not from a wallet's history.

What to do

• If you used Railway: move funds out of any wallet whose key was in an environment variable, to a new key, even if it hasn't been touched.

• HitBTC: freeze the account behind deposit addresses 0xf006355119fd57be5412369dfcd7e76d78936e8e, 0xffc890fe09053f1f04565c7a1f3161df885cf1cd (Arbitrum) and 0x1cadfb6fb68c555cc0657537022b178d65a007da (Ethereum), and the 14.34 ETH sent to 0x80787af194c33b74a811f5e5c549316269d7ee1a in 0x9ac5318283604417125cc42189a5205c75757411d0f228cfed1273fe2aa26788.

• Circle can freeze 55,046.92 USDC at 0xaaa939dacff5ce411995eaa5d16dc307ca29901c and 9,372.18 USDC at 0xd9773325282874d18cb83f1fe50f14c39750b2ee on Ethereum, and 15,186.71 USDC at 0xa3cce5eb44ab3efd88a52cd43f95bc9495e2c0a3 on Polygon. Tether can freeze 998.96 USDT at 0x11afddca3f85f50b30b9114891e7bc386faee434 on Celo.

• Victims: report to HitBTC with the deposit addresses and transaction hashes above, and file a police report.

Addresses

• Sweeper (all chains): 0xd9773325282874d18cb83f1fe50f14c39750b2ee

• HitBTC deposit addresses: 0xf006355119fd57be5412369dfcd7e76d78936e8e, 0xffc890fe09053f1f04565c7a1f3161df885cf1cd (Arbitrum), 0x1cadfb6fb68c555cc0657537022b178d65a007da (Ethereum)

• Held the 14.34 ETH before HitBTC (Ethereum): 0x78421155a6ff1adbb471672b501b715cf66ce065

• Parked USDC: 0xaaa939dacff5ce411995eaa5d16dc307ca29901c (Ethereum), 0xa3cce5eb44ab3efd88a52cd43f95bc9495e2c0a3 (Polygon)

• Parked USDT (Celo) and ETH (MegaETH): 0x11afddca3f85f50b30b9114891e7bc386faee434

• Parked ETH: 0x07e2d8eb2d40eff119951998d94eb91107f776f5 (Arbitrum), 0x279971e36d4efba805c113e800cf4b5fac4d6be5 (Optimism)

Sources

• Railway: security disclosure, Oct 21, 2026

• @tayvano_ on the theft address

• On-chain data: Ethereum, Base, Arbitrum and BNB Chain through Alchemy; about 95 other EVM chains through their public RPCs and explorers; bridge records (Across, Meson, Mayan, LI.FI, Relay, Circle CCTP); Iris's labels.

Limits

About $1.2k sent through HiFiSwap from Polygon couldn't be followed to its other side. The attacker was still active at 02:43 UTC on Oct 22, so balances may change. USD values use ETH at about $2,450 to $2,480 at the time.