Initia Confirms Second Exploit in Three Weeks, $3.27M Stolen

Initia said an attacker took $3.27 million in digital assets in the network’s second exploit in less than three weeks, prompting a halt while about $2.16 million remains frozen.

Initia linked Monday’s attack to a compromised Google Cloud Platform key used in a command injection. The project said the breach exposed environment variables, giving the attacker access to its GitHub and cloud accounts and additional credentials.

Initia said the attacker accessed Anvil, its rollup-hosting platform, and processed fraudulent Inter-Blockchain Communication withdrawals from five rollups, releasing assets held in escrow. The project said the attacker sold assets on its decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens were withdrawn.

Initia halted its layer-1 network Tuesday. Recovery efforts are underway with law enforcement and security partners, and the project plans to restore backing for affected assets.

Initia said the latest incident follows an Oct. 23 exploit that drained about $2.7 million. That attack used a MoveVM script cache vulnerability to bypass security checks and create unbacked token balances that were bridged out of the network.