Initia confirms second exploit in 3 weeks, $3.27M stolen in latest attack
Initia, a layer-1 blockchain network, confirmed on Wednesday that it has suffered a second security exploit in less than three weeks, with an attacker stealing about $3.27 million in crypto assets.
The company said the attacker gained unauthorized access on Monday through a command injection attack involving a compromised Google Cloud Platform key. The breach exposed environment variables, allowing the attacker to access Initia’s GitHub and cloud accounts and obtain additional credentials.
According to Initia, the attacker accessed Anvil, a platform hosting rollups, and validated fraudulent Inter-Blockchain Communication (IBC) withdrawals from five rollups, releasing assets held in the network’s escrow accounts.
Initia halted its layer-1 on Tuesday and said it intends to restore the backing of affected assets. The blockchain said recovery efforts are ongoing with its law enforcement and security partners.
The incident follows an Oct. 23 exploit that saw an attacker drain about $2.7 million after exploiting a vulnerability in Initia’s MoveVM script cache.
Assets and next steps
Initia said about $2.16 million of the stolen assets remain frozen on its halted network. The attacker sold assets on Initia’s decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens were withdrawn.
The company is working with law enforcement and security partners to recover the funds and restore the backing of the affected assets.
Related
