Crypto thefts: Series of attacks on wallets revives concerns around Railway

Coin Encyclopedia Improve your knowledge of cryptos

He suspects a link with the security incident suffered by the host Railway in October. This hypothesis is not confirmed, and the total amount of losses remains to be established.

In his publications on X, Carlos explains that he discovered that one of his old hot wallets, a wallet whose keys are accessible to a connected environment, had been emptied.

By his count, 96 wallets experienced withdrawals exhibiting a similar pattern in some 70 minutes, starting at 4:11 p.m. UTC. He also indicates having spotted activity on other blockchains, without having completed their analysis. These are preliminary observations, not a consolidated assessment.

Carlos specifies that the operations from his wallet were signed with his own key. This suggests that the attacker obtained the private key, recovery phrase, or signing access. This finding, however, does not reveal how this access was acquired.

The report concerns a personal portfolio of the manager. The information available does not allow us to conclude that the Definitive platform or its users' funds have been compromised.

Carlos also mentions more than $110,000 worth of stablecoins moved via RelayDepository in two transactions over a month. This amount does not constitute the total losses of the 96 portfolios.

On October 21, Railway issued a security alert after detecting abnormal activity on its environment variable storage systems. This data may contain API keys, database identifiers or other application secrets.

The company indicated that an unauthorized third party had potentially accessed encrypted variables and obtained the decrypted content of some of them. It then recommended renewing the secrets stored on its platform.

In its preliminary report, Railway specifies that the intrusion targeted its internal systems, without connection to individual customer accounts. It maintains its recommendation to revoke and replace the affected sensitive identifiers.

However, no public reconciliation demonstrates at this stage that the keys to the 96 wallets were all hosted at Railway. The lead put forward by Carlos remains a possible explanation.

For an exposed private key, changing a password or revoking contract authorizations is not enough: security requires a new wallet, equipped with new keys generated in a healthy environment. Identifying the origin of the theft and quantifying the losses remain the main unknowns in this case.

Machine-translated from French