Current outcome
After disclosing unauthorized access to its environment-variable storage, Railway issued guidance for users with Google Cloud service-account keys to rotate credentials, redeploy, and audit cloud activity; the incident remains reported as possibly linked to the suspected Swell DAO admin-key compromise.
Progress timeline
2 material updates- #01
Railway曝安全事件：部分密钥明文恐遭窃取，攻击疑似瞄准AI服务商
Railway disclosed unauthorized activity in its environment-variable storage that may have exposed encrypted and possibly plaintext customer secrets, prompting all users to rotate keys and temporarily halting platform-wide builds and deployments.
Source evidence: theblockbeats
- #02
【Railway 建议用户排查谷歌云异常访问，并更换可能泄露的服务账号密钥】
Railway issued follow-up guidance for users with Google Cloud service-account keys to disable and rotate potentially leaked keys, redeploy services, and audit cloud logs and billing; the report also links the incident to the suspected compromise of Swell DAO swETH/rswETH admin keys.
State after update: After disclosing unauthorized access to its environment-variable storage, Railway issued guidance for users with Google Cloud service-account keys to rotate credentials, redeploy, and audit cloud activity; the incident remains reported as possibly linked to the suspected Swell DAO admin-key compromise.
Source evidence: foresightnews