Initia Blames Stolen Cloud Key for Second Breach in Three Weeks

Initia says an attacker got in on Monday by abusing a command injection flaw tied to a compromised Google Cloud Platform key. That opened up environment variables, which gave the intruder a path into the project’s GitHub and cloud accounts and let them pick up more credentials. With that access, the attacker reached Anvil, the platform that hosts Initia’s rollups, and approved fake IBC withdrawals from five rollups, draining assets from the network’s escrow accounts.

What the Attacker Took and What Remains Frozen

The thief sold assets on Initia’s own decentralized exchange and pulled out 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens left the network. About $2.16 million of the stolen funds is still frozen on the halted chain.

Initia Halts the Chain and Starts Recovery

The team stopped its layer-1 on Tuesday and says it plans to restore the backing of the affected assets. Recovery work continues alongside law enforcement and security partners.

Earlier Exploit on Oct. 23

This is not the first incident. On Oct. 23, an attacker drained roughly $2.7 million through a weakness in the MoveVM script cache, which let malicious code skip security checks and mint unbacked token balances that were then bridged out.