Initia hack: compromised cloud key drains $3.27 million and halts the blockchain - CryptoTicker.io

The attack on Initia started in the project's cloud infrastructure. On Monday, November 9, an attacker gained unauthorized access through a command injection attack, exploiting a compromised Google Cloud key meant for setting up private nodes. This allowed the attacker to reach environment variables, open Initia's GitHub and cloud accounts, and access credentials for Anvil, the platform where the network's rollups run.

With this access, the attacker confirmed forged IBC (Inter-Blockchain Communication) withdrawals from five rollups on Tuesday, November 10. Validators immediately halted the layer-1 blockchain, preventing further transactions and freezing approximately $2.16 million of the $3.27 million total stolen. The affected assets are bridged tokens such as USDC and TIA, with no INIT tokens taken according to Initia.

Attack method and damage

Command injection enabled the attacker to smuggle commands into system inputs, leading to the compromise of Google Cloud credentials. This access point allowed control over the rollup infrastructure, where the attacker confirmed operations that should never have occurred. The forged IBC withdrawals emptied escrow accounts without cracking any smart contracts.

gained unauthorized access to Initia's infrastructure through a command injection attack

The attacker sold part of the stolen assets on Initia's decentralized exchange, withdrawing 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC. Of the total $3.27 million stolen, approximately $1.1 million has left the Initia ecosystem while $2.16 million remains frozen on the halted network.

Second incident in weeks

This marks Initia's second security incident in three weeks. On October 23, an attacker exploited a bug in the MoveVM script cache, resulting in $2.7 million being drained. While technically different—the first involved protocol code, while this exploited operating environment—both incidents required network halts.

The repeated breaches raise questions about internal processes, including key management, access controls, and monitoring of unusual withdrawals. Initia has not confirmed whether the same attacker is responsible for both incidents.

Market response and user protection

Despite the security breach, INIT's price has risen 102% in the past week, trading around $0.26 with a market cap of $57 million. The unusual price movement may reflect short position covering or speculative bets on recovery, though the project hasn't provided an official explanation.

Initia has announced it will restore backing for affected tokens but hasn't specified how or when the network will restart. Users holding tokens on the blockchain or its rollups cannot move them, though exchange trading continues. The project warns against fake refund sites and advises checking token approvals with tools like Revoke.cash.