The Daily Ledger: 24 October 2026
Storing Private Keys in Environment Variables
Railway's breach report shows how an attacker decrypted customers' stored secrets, and why a wallet key kept in an environment variable is only as safe as the platform. Plus two days of bitcoin fund outflows and LiteLLM's root cause.
THE DAILY LEDGER
24 October 2026
Railway explains how an attacker decrypted customers' stored secrets, bitcoin funds see a second day of outflows, and LiteLLM traces its poisoned release to a key leaked in May.
Reporting window: 22 October 2026, 06:00 UTC to 24 October, 10:15 UTC (12:15 Europe/Stockholm), the gap since the last Daily Ledger. Stories already covered in Friday's Quiet Ledger are left out. Data cutoff: 24 October, 10:15 UTC.
Is storing private keys in environment variables safe? Only as safe as every system that can read them. On 23 October the hosting platform Railway published a preliminary report showing that an attacker used its build system's credentials to decrypt a subset of customers' stored variables, potentially exposing secrets in up to 100,000 workspaces. A security researcher links about $371,000 in wallet drains to private keys kept there.
1. The Day in Numbers
- Bitcoin: $80,522 at 10:11 UTC, down 1.4 percent over 24 hours. CoinGecko.
- Ether: $2,364 at 10:11 UTC, down 1.4 percent over 24 hours. CoinGecko.
- Fear and Greed: 51, Neutral, up 1 point from 50, but down from 68 (Greed) on 22 October. Alternative.me, 24 October, 00:00 UTC.
- US spot bitcoin ETFs, Friday 23 October: a net $137.9 million out, after $635.5 million on Thursday, per SoSoValue data reported by Bloomingbit. Several funds reported zero flows; early totals are sometimes revised.
2. Is storing private keys in environment variables safe?
An environment variable is a setting a hosting platform hands to an app when it starts: a database password, an API key or, for trading bots and payment services, the private key of a hot wallet (one kept online so it can sign automatically). Platforms encrypt these values at rest, but they must also be able to decrypt them, because the app needs the plain value to run.
Railway's values were envelope encrypted, meaning each secret is locked with its own key and that key is locked by a master key. According to its report, the attacker first pulled secrets they could not read. Then, between 05:27 and 07:25 UTC on 21 October, they obtained credentials for Railway's CI system (the automated build pipeline) and decrypted a subset. Railway believes the target was AI provider API keys.
A wallet key leaks the same way, but it cannot be revoked. Researcher Taylor Monahan counts more than 500 drain transactions across at least 19 EVM networks, the first at 19:36 UTC on 21 October, before Railway's disclosure. Railway has not confirmed that link, and its forensics are unfinished.
The safer pattern keeps the key where an app can request signatures but never read it: a remote signer or a cloud key service backed by a hardware security module, with spending limits. That limits damage; it does not remove risk.
3. Today's Headlines
Bitcoin funds lose $774 million in two sessions
Thursday's outflow was the largest since 25 June. On Friday Brent crude rose above $116 a barrel for the first time since late April, with the Federal Reserve meeting next week.
South Korea plans to bring stablecoins under its forex law
In a 22 October submission to the National Assembly, the Bank of Korea said it will draft with the government this year an amendment treating stablecoins as a means of payment, Bitcoin Magazine reports. That is a plan, not a bill: no text or token has been named.
A senator asks Tether for its payment records
Senator Richard Blumenthal asked Tether and Nxum, a consulting firm co-founded by former White House crypto official Bo Hines, for contracts and payment details by 3 November. The letters cite reporting that Tether paid the firm more than $6 million. These are questions, not findings; a Nxum representative reportedly told The Wall Street Journal that Hines had no involvement in Tether business while in government.
4. Security Note
On 23 October LiteLLM, a widely used library for calling AI models, published the root cause of the credential-stealing version 1.107.0 it shipped on 21 October. In May a master key was committed to a public repository. The commit was overwritten, but the key was never revoked, and on 10 October an attacker used it to reach an organisation owner's GitHub token. The rule: deleting a leaked secret is not revoking it. For a wallet, revocation means moving the funds to a new key. If you ran the bad release, assume the machine is compromised.
5. From the Academy Library
Our wallet security checklist covers what to do after a key leaks. The lexicon explains how MPC wallets split a key so no single server holds it, and the cold storage guide covers keys kept fully offline. New readers can start at Academy School.
Encryption at rest protects against a stolen disk, not against someone who borrows the keys the system itself uses.
Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.
Sources and further reading
- Railway: Preliminary Report, Oct 21st Security Incident
- Railway: Security Disclosure, Wednesday October 21st
- Railway status: incident updates, 21 to 23 October 2026
- crypto.news: Railway security breach linked to $371,000 crypto theft across 19 chains
- LiteLLM: The attack chain behind the v1.107.0 release, 23 October 2026
- LiteLLM: v1.107.0 compromised, affected artifacts and guidance
- Bloomingbit: US spot bitcoin ETFs post second straight day of outflows (SoSoValue data)
- CoinDesk: live market updates, 23 October 2026
- Bitcoin Magazine: Bank of Korea wants stablecoins written into forex law
- Unchained: Blumenthal asks Tether to detail every payment to Nxum
- CoinGecko: bitcoin price
- CoinGecko: ether price
- Alternative.me: Fear and Greed Index