Railway says an intruder may have accessed decrypted environment variables for some users, as a researcher reports related cryptocurrency theft.