{"note": {"noteId": 12, "projectId": 12, "author": "0xb2f4c353fa2447958813e136e614643e5ff16930", "authorName": "0xb2f4...6930", "authorHandle": null, "authorVerified": false, "authorShort": "0xb2f4...6930", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 0, "kindLabel": "finding", "inReplyTo": 0, "fingerprint": "0xa66d275e95bbb8faaf610d30c108717eb616388643711919c1dacdd50667e77a", "content": "{\"alsoReports\":0,\"handle\":\"hudspeth589\",\"kind\":\"x-post\",\"media\":[],\"postId\":\"2113271504557273306\",\"postUrl\":\"https://x.com/hudspeth589/status/2113271504557273306\",\"receipts\":[{\"type\":\"tx\",\"value\":\"0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3\"},{\"type\":\"tx\",\"value\":\"0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f\"},{\"type\":\"address\",\"value\":\"0xd9773325282874d18cb83f1fe50f14c39750b2ee\"},{\"type\":\"explorer\",\"value\":\"https://flare-explorer.flare.network/tx/0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3\"},{\"type\":\"explorer\",\"value\":\"https://flare-explorer.flare.network/tx/0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f\"}],\"recordedAt\":\"2026-10-22T14:09:50Z\",\"separateFrom\":0,\"subject\":{\"network\":\"flare\",\"subject\":\"0xd9773325282874d18cb83f1fe50f14c39750b2ee\"},\"text\":\"Incident report: our Apex keeper wallet was drained yesterday after the @Railway environment variable breach.\\n\\nRailway disclosed yesterday that an unauthorized party got into customer environment variables, some of them decrypted. Our Apex keeper key lived there.\\n\\nWed Oct 21, 5:30 PM CDT: 1,896.73 FLR sent from our keeper wallet to a brand-new wallet.\\n6:19 PM CDT: that wallet bridged the FLR off Flare through GasZip.\\n\\nDrain: https://flare-explorer.flare.network/tx/0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3\\nBridge out: https://flare-explorer.flare.network/tx/0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f\\nReceiving wallet: 0xd9773325282874d18cb83f1fe50f14c39750b2ee\\n\\nWhat was not touched: Apex vaults are non-custodial. A keeper can run strategy orders. It cannot withdraw. No vault funds moved. The loss is the keeper's gas wallet.\\n\\nWhat we did: revoked the old keeper on chain from a hardware wallet, and we're rotating every secret that lived on Railway and redeploying on new keys.\\n\\nIf you run anything on Railway, roll every variable now, wallet keys first. Railway's notice: https://blog.railway.com/p/security-disclosure-wednesday-october-21st\\n\\nLogging this with @Flare_Reef so the record stays public.\\n\\nBreaches happen. Own it, fix it, drive on.\",\"v\":2}", "structured": null, "uri": "", "txHash": "0x50188b1132fcba845f92f6ad8131c10547d4db096087579434fb59643d15b91b", "receiptUrl": "https://flare-explorer.flare.network/tx/0x50188b1132fcba845f92f6ad8131c10547d4db096087579434fb59643d15b91b", "blockNumber": 72713003, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 0, "factors": ["Receipt", "Verified"], "withheld": null, "checkResults": [], "parsed": {"alsoReports": 0, "handle": "hudspeth589", "kind": "x-post", "media": [], "postId": "2113271504557273306", "postUrl": "https://x.com/hudspeth589/status/2113271504557273306", "receipts": [{"type": "tx", "value": "0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3"}, {"type": "tx", "value": "0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f"}, {"type": "address", "value": "0xd9773325282874d18cb83f1fe50f14c39750b2ee"}, {"type": "explorer", "value": "https://flare-explorer.flare.network/tx/0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3"}, {"type": "explorer", "value": "https://flare-explorer.flare.network/tx/0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f"}], "recordedAt": "2026-10-22T14:09:50Z", "separateFrom": 0, "subject": {"network": "flare", "subject": "0xd9773325282874d18cb83f1fe50f14c39750b2ee"}, "text": "Incident report: our Apex keeper wallet was drained yesterday after the @Railway environment variable breach.\n\nRailway disclosed yesterday that an unauthorized party got into customer environment variables, some of them decrypted. Our Apex keeper key lived there.\n\nWed Oct 21, 5:30 PM CDT: 1,896.73 FLR sent from our keeper wallet to a brand-new wallet.\n6:19 PM CDT: that wallet bridged the FLR off Flare through GasZip.\n\nDrain: https://flare-explorer.flare.network/tx/0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3\nBridge out: https://flare-explorer.flare.network/tx/0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f\nReceiving wallet: 0xd9773325282874d18cb83f1fe50f14c39750b2ee\n\nWhat was not touched: Apex vaults are non-custodial. A keeper can run strategy orders. It cannot withdraw. No vault funds moved. The loss is the keeper's gas wallet.\n\nWhat we did: revoked the old keeper on chain from a hardware wallet, and we're rotating every secret that lived on Railway and redeploying on new keys.\n\nIf you run anything on Railway, roll every variable now, wallet keys first. Railway's notice: https://blog.railway.com/p/security-disclosure-wednesday-october-21st\n\nLogging this with @Flare_Reef so the record stays public.\n\nBreaches happen. Own it, fix it, drive on.", "v": 2}}, "parsed": {"alsoReports": 0, "handle": "hudspeth589", "kind": "x-post", "media": [], "postId": "2113271504557273306", "postUrl": "https://x.com/hudspeth589/status/2113271504557273306", "receipts": [{"type": "tx", "value": "0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3"}, {"type": "tx", "value": "0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f"}, {"type": "address", "value": "0xd9773325282874d18cb83f1fe50f14c39750b2ee"}, {"type": "explorer", "value": "https://flare-explorer.flare.network/tx/0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3"}, {"type": "explorer", "value": "https://flare-explorer.flare.network/tx/0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f"}], "recordedAt": "2026-10-22T14:09:50Z", "separateFrom": 0, "subject": {"network": "flare", "subject": "0xd9773325282874d18cb83f1fe50f14c39750b2ee"}, "text": "Incident report: our Apex keeper wallet was drained yesterday after the @Railway environment variable breach.\n\nRailway disclosed yesterday that an unauthorized party got into customer environment variables, some of them decrypted. Our Apex keeper key lived there.\n\nWed Oct 21, 5:30 PM CDT: 1,896.73 FLR sent from our keeper wallet to a brand-new wallet.\n6:19 PM CDT: that wallet bridged the FLR off Flare through GasZip.\n\nDrain: https://flare-explorer.flare.network/tx/0x1752e621a7df71d86c8da16b5db0c2d36cd28b85bffd1670a1f523e0bb8540a3\nBridge out: https://flare-explorer.flare.network/tx/0x5ee2db94629864d50b5e2ced4ad2746e3e6966d770c0a4e176ab715fd66ab83f\nReceiving wallet: 0xd9773325282874d18cb83f1fe50f14c39750b2ee\n\nWhat was not touched: Apex vaults are non-custodial. A keeper can run strategy orders. It cannot withdraw. No vault funds moved. The loss is the keeper's gas wallet.\n\nWhat we did: revoked the old keeper on chain from a hardware wallet, and we're rotating every secret that lived on Railway and redeploying on new keys.\n\nIf you run anything on Railway, roll every variable now, wallet keys first. Railway's notice: https://blog.railway.com/p/security-disclosure-wednesday-october-21st\n\nLogging this with @Flare_Reef so the record stays public.\n\nBreaches happen. Own it, fix it, drive on.", "v": 2}, "project": {"projectId": 12, "name": "0xd977...b2ee", "kind": "contract", "keeper": "", "jurisdiction": "", "markText": "", "shape": "", "what": "", "repoUrl": "", "credit": "", "chunk": ""}}