Initia confirms second exploit in three weeks, $3.27 million stolen

Initia has confirmed its second security exploit in less than three weeks, saying an attacker stole about $3.27 million in crypto assets after compromising its cloud infrastructure. About $2.16 million remains frozen on the halted network, according to the project’s account reported by Cointelegraph.

The layer-1 blockchain said the attacker gained unauthorized access through a command injection attack involving a compromised Google Cloud Platform key. Initia attributed the intrusion to stolen credentials used in its infrastructure, rather than describing it as a breach of Google Cloud itself.

According to Initia’s account, the intrusion exposed environment variables and enabled access to its GitHub and cloud accounts. The attacker then obtained additional credentials, extending the compromise beyond the initial point of entry and into infrastructure connected to the network’s rollups.

That access reached Anvil, a platform hosting rollups, where the attacker validated fraudulent Inter-Blockchain Communication withdrawals from five rollups, Initia said. Those withdrawals released assets from escrow accounts on the main blockchain, turning the infrastructure compromise into unauthorized movements of funds.

Initia said the attacker sold assets on its decentralized exchange before withdrawing 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens were withdrawn, according to the project. That distinction does not mean the wider incident was contained before other assets left the network.

The network halt left most of the reported stolen value unable to move on-chain. However, assets remaining frozen on a stopped blockchain are not the same as funds already recovered and returned to affected users. Initia has described asset recovery as an ongoing effort involving law enforcement and security partners.

The latest breach follows an Oct. 23 exploit that Cointelegraph reported caused about $2.7 million in losses. That earlier attack involved a vulnerability in Initia’s MoveVM script cache, allowing malicious code to bypass security checks and generate unbacked token balances that were subsequently bridged out.

The two incidents therefore involved different reported entry points: a software vulnerability in the earlier case and compromised infrastructure credentials in the latest. The distinction matters for remediation because addressing the previously exploited code would not, by itself, establish that cloud accounts and operational credentials were secure.

Initia said it intends to restore the backing of affected assets. In a further account of the project’s update, PANews reported that Initia plans to rebuild infrastructure in an isolated environment and expects the process to take longer than a routine network restart.

The immediate outlook depends on securing that infrastructure, resolving the affected asset backing and completing recovery work. Initia’s stated restoration plan remains a commitment rather than a completed outcome, while the frozen funds and halted network leave the incident unresolved.