automated unauthorized on-chain transactions and fund drainage by an external sweeper bot.

Question

### 1. Incident Overview

Our production application backend hosted on Railway held our non-custodial relayer private key (`RELAYER_PRIVATE_KEY`) within Railway's Environment Variables.

Between November 7, 2026, and November 10, 2026, unauthorized third-party automated sweeper bots began immediately intercepting and sweeping all incoming funds and gas transferred to this private key across Base (Chain ID: 8453) and BNB Smart Chain (Chain ID: 56). This private key was strictly stored inside Railway environment variables and local gitignored configuration (never committed to GitHub or public repositories).

---

### 2. Forensic & On-Chain Transaction Evidence

* **Victim / Compromised Address:**

`0x3A5668F8B3E167771d503F0321c42a7B082789Ef`

* **Attacker Sweeper Bot Contract / Wallets:**
  * `0xf15ad1114442a06ed806d2486071d25d5c18a8fb`
  * `0xf15ae039f47b21b16b7795748cbb313aa378a8fb`
  * `0xf15a239b8379304078b561791834e0babfc5a8fb`

* **Recent Unlawful Sweeper Transactions on Base Mainnet:**
  1. **Tx Hash:** `0xd88afaa6af58165fb6632a09621745a588b850d877752d62f9319287ff822a7c`
     * **Block:** 55523682
     * **Action:** Automated token transfer to attacker `0xf15ad111...`
  2. **Tx Hash:** `0x8f4dddffb73834fe832f769adf35a5837fceefa5bef4e09cbe6c6d6c94cdd103`
     * **Block:** 55523648
     * **Action:** Automated token sweep to attacker `0xf15ad111...`
  3. **Tx Hash:** `0x49803f5a805c1cf9463a432958475012f28fcb1dc624c3ce30aa5a1daad92e56`
     * **Block:** 55524490
     * **Action:** Automated token sweep to attacker `0xf15ae039...`
  4. **Tx Hash:** `0x7266cf7093e8c98c4e995a827d3ba648e473d7e2748b6e17f367b0436733fcf7`
     * **Block:** 55524569
     * **Action:** Automated token sweep to attacker `0xf15a239b...`

---

### 3. Mitigation Steps Taken

We have taken immediate containment action:

1. Revoked all permissions, relayer authorizations, and ownership from the compromised key on all smart contracts on Base and BSC.
2. Migrated all users and funds to newly generated cryptographic keys.
3. Completely abandoned the compromised wallet `0x3A56...`.

---

### 4. Urgent Request from Railway

Given the severity of this credential leak:

1. Please provide access logs and audit trails for our Railway project, team account, and environment variable views/edits for the dates **Nov 6, 2026 – Nov 10, 2026**.
2. Please inspect whether any unauthorized IP addresses, API sessions, or platform vulnerability accessed our project's encrypted variables.
3. Confirm if any incidents or security advisories regarding variable exfiltration have occurred on Railway during this timeframe.

Thank you for your prompt investigation.