Crypto Private Key Leaks: What the Railway and XRPH Drains Show

If you don't want to wake up to a drained wallet, you need to know the five places your keys actually leak from. Because on the evening of 21st of October, someone started emptying crypto wallets. More than 200 addresses and at least 19 blockchains, around $371,000, according to one security researcher. And the public warning didn't go out until more than 2 hours later. Nobody broke a blockchain, somebody just got the key.

So in this video, I'll walk you through all five leak points, a real case for each one from the last few weeks, and exactly what I do about it as a trader. Now stick around for number five, it's a feature built into the XRP ledger that most holders have never actually switched on. And I've got a free key leak audit for you at the very end. Now quick disclaimer, education and commentary only, not financial advice. Crypto is volatile and you can lose money, but we're going to jump straight into it.

[music]

Number one is where your key was born. Now most people think a seed phrase is safe because it's long, 12 words, 24 words, looks completely random. But that's only true if it was actually random when it was made. Now on 17th of October, a blockchain called Qubit had 1,404 wallets drained in 104 minutes, around $1.3 million. The blockchain itself wasn't hacked.

The project says some seeds were generated with weak randomness. Wallets made in a browser on an iPhone or iPad, or in Safari on a Mac. So the attacker didn't guess one seed, they worked through every seed the software could have produced, and checked which ones had money in them. And before you think that's some tiny coin, not my problem, the same thing happened to XRP holders in September. The XRP H wallet app from XRP Healthcare, 4,011 wallets swept in about 3 hours.

That was 267,664 XRP gone. Now, according to xrpl.to, the company's own report says a bug added back in June 2023 shrank the number of possible keys, so they could be rebuilt offline. Again, not an XRP ledger problem, an app problem. But if your XRP was in that app, that's not much comfort. And if you appreciate me making this type of content, let me know by gently tapping that like button and hitting that subscribe button.

We are going for 400,000 subscribers by the close of the year. And if you're holding $50,000 or more and want help putting this into a proper system, click that top link in the description. It will take you through to free training, but I'm going to explain that more later on. Now, it's not only apps. Earlier in October, Ledger devices sold through one reseller in Southeast Asia turned out to have hidden implants that expose users' seed phrases.

Losses from those devices have been estimated at around $90 million or more. So, "I've got a hardware wallet" isn't the whole answer. Where you bought it matters, too. Buy direct from the maker and never use a device that arrives with a recovery phrase already written down. And here's how I think about it as a trader.

When I look at a setup, I don't just ask, "Is this good?" I ask, "Where did this information come from?" And that is the same with keys. So, for every wallet holding real money, write down what created it. A hardware device, a big well-known wallet, or some project's own app you downloaded because they offered staking. Now, if the answer is a small project's app or a browser, that wallet doesn't hold my main bag. I'd make a fresh wallet on a dedicated device, send a small test amount, then move the rest over.

Now, stay with me because number two is where I see real money going missing, and it's the freshest one yet. Number two is where your key lives. Now, we're going to go back to the 21st of October. Railway is a cloud platform. Developers use it to run apps, websites, and a lot of crypto bots.

And that night, Railway said an unauthorized party may have accessed the secret settings customers stored there and decrypted some of them. It told every customer to replace all of their keys. Now these settings are where people keep API keys, passwords, and for some crypto bots, the actual private key of a hot wallet. Security researcher Tal Be'ery then linked around $371,000 in drains to keys stored on Railway. That was over 500 transactions and more than 200 addresses.

At least 19 chains and Railway hasn't confirmed that link. So treat it as a researcher's count, not a final number. Now you're probably thinking, "Josh, I don't run trading bots on a cloud server." And that's fair. But ask yourself where your seed phrase has ever been typed or saved. If it's a photo on your phone that backs up to the cloud, a note in your email drafts, a file called crypto in your Google Drive, every one of those is your key living on someone else's server, protected by someone else's security team.

Now I'm not saying never use the cloud for anything. I'm saying the one secret that controls your whole bag shouldn't sit somewhere a breach at another company becomes your problem overnight. The XRP hack case had this too. xrpl.to reported the app stored seeds unencrypted on the phone and its staking feature sent seed information to the company's server. And of 1,225 wallets that had used staking, 1,198 were drained. Now my rule here is simple.

The seed for my long-term bag has never touched anything that connects to the internet. Paper or metal stored somewhere physical with a second copy somewhere else. If I've ever typed it into something online, I treat it as already leaked and I move to a brand new seed. Now quick one, if you're new here, subscribe. Every week I'm going to break down what's actually happening crypto from a trader's point of view for people who hold serious amounts and want to keep it.

Now number three is keys that aren't secret anymore. Now this sounds obvious until you see how it actually happened. On the 15th of October, OpenAI published a report about one of his own test AI models. It needed some crypto to finish a coding task and it didn't have any. So, it wrote a script and it took seed phrases that are publicly known in the developer world, generated the addresses, and checked 362 of them until it found one with funds, then it spent them.

To be clear, these were test network coins with no real money value. OpenAI reported it as a model misbehaving. Nobody lost their savings, but look at what it shows. A machine doesn't need to hack you, it just needs your phrase to be on a list somewhere and it checks every address in seconds. Now, sweeper bots have been doing this to real wallets for years.

So, how does a normal person's phrase end up known? You typed it into wallet validation or sync website. You read it out to support on Telegram. You used the example phrase from a tutorial just to test. Or, someone else set the wallet up and handed you the words.

If any of that is you, that phrase is burned. Not maybe, burned. New seed generated by you on your device and nobody asked you for it. Not support, not a recovery service, not even me or the team at Bull Run. Now, number four, and this is the one serious holders miss most.

The keys you didn't know you made. Every time you connect a tax app, a portfolio tracker, or a trading bot to your exchange, you create an API key. Now, that's a second door into your exchange account and depending on how it's set up, it doesn't need your password or your two-factor authentication. Now, think about how many tools you've connected over the years. A tracker you tried once, a bot someone in a group chat recommended, a tax app from two filing seasons ago.

Unless you set an ex- piry or deleted them, a lot of those keys are probably still sitting there, still working in the background. Now, the Railway story was exactly this. People had exchange API keys sitting in those cloud settings. And if a key like that has withdrawal permission, it's close to an open account. And as a trader, I've used API keys for years and here's the rule I don't break.

A key only gets the permission the job needs. A tax tool needs to read your history. That's it, read only. A tracker, read only. A bot might need to trade, but it should never need to withdraw.

So, here's the order. Log in to every exchange you use. Find the API management page. Look at the list, then delete any key you don't recognize or don't use anymore. And if a key has withdrawal rights and doesn't need them, delete it and make a new one without.

Where the exchange offers it, lock each key to a fixed IP address and turn on a withdrawal address allow list. So even if someone gets in, coins can only go to the addresses you approved in advance. Then go ahead and check your recent login and API activity. Anything from somewhere you don't recognize, change everything. Now I get it it takes about 15 minutes and it's the one most people skip, but it'd be the one that saves your bank.

Now number five, and I promised you this one, one key controls everything. Now for most wallets, if your seed leaks, that's it. There's no reset, you move everything to a new wallet and hope you get there before the thief does. Now the XRP ledger works different and most XRP holders have never used this. Every XRP ledger account has a master key.

That's the one from your original seed, but you can also set a regular key, a second key pair that can sign your transactions instead. The idea, straight from the XRP ledger's own documentation, is this: keep the master key offline, somewhere safe. Use the regular key day-to-day. And if the regular key ever gets leaked, you get the master key out of storage and replace or remove the regular key. Same account, same address, same settings.

You don't have to rebuild everything from scratch. Now there's also multi-signing and that's where a transaction needs, say, two out of three keys to go through. So one leaked key on its own can't actually move anything. Now two honest caveats. One, this doesn't make you faster than a thief.

The documentation is clear, you might not stop the theft, but you keep control of the account. Number two is set this up wrong and you can literally lock yourself out. So if you do it, learn it properly, try it on a small test account first, and never paste a key into a random website to do it. Now here's why I like this from a trading point of view. In trading, you never want one single point of failure.

You have a stop, you have position sizing, you have a plan for when you're wrong. Your keys should work the same way. One leaked key shouldn't be the end of the story, and it's not just XRP. On other chains, you'd look at things like multi-sig wallets or splitting a big bag across separate wallets. The tool changes, the principle doesn't.

And this is where I see most people that they don't actually have a system. They've got coins on two exchanges, an app on their phone, a hardware wallet in a drawer, and no idea which one is the weak link. And here's what one member said about working with our team. I know I can trust these folks. They are sincere and go the extra mile to help.

And this can all be found on the Trustpilot website. So, if your crypto adds up to $50,000 or more, XRP and everything else, and you want help building this properly, that's what the accelerated program is for. You become your own bank and operate from a repeatable system instead of holding and hoping. So, go ahead, tap that first link in the description. You'll get some free training first, and if it makes sense, you can book a strategy call with the team.

Now, we're going to jump straight into a quick recap. The five places your keys leak. One, where the key was born. Weak randomness and small project apps. Two, where it's stored.

Anything that syncs to a server. Three, who else knows it? That's validation sites, fake support, example phrases. Number four, API keys you forgot you made. Read only, no withdrawals allow list on.

And number five, one key controlling everything. On XRP, look at a regular key setup carefully. And here's the bonus I promised, the key leak audit and I'd run this weekend. Just go ahead and screenshot this now. For every wallet holding real money, write down three things.

What created it? Where the seed is stored? And who has ever seen it? If any answer is browser, small app, cloud, or or someone else, that wallet gets moved instantly. And for every exchange, list your API keys.

Anything with withdrawals rights or anything you don't use, delete it. Turn on the withdrawal allow list wherever it's offered. And for your main XRP account, decide whether a regular key setup makes sense for you. If it does, practice on a test account first. So, that's five lines most of you can do in an afternoon.

And like I said, if you're holding $50,000 or more, and you'd rather build this with a team than on your own. The top link of the description will take you to that free training. And if you want the next layer of protecting a bigger bag, watch this video next. It's the five things I'd do if I held 10,000 XRP. Now, thank you very much for watching.

You know what to do. I'll see you at the top. Stay bullish.