Cryptoupdated 26m ago2 min read
Initia Confirms Second Security Exploit, $3.27 Million Stolen After Cloud Key Compromise
6outlets comparedWhere the coverage agrees
4 Other1 West Asian1 Western AlternativeThis article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Attacker stole about $3.27 million after compromising Initia's cloud credentials. Initia suffered second security exploit in under three weeks, network halted; remaining $2.16M frozen.
Save coverage image
Second exploit, $3.27M stolen
Initia confirmed a second security exploit in less than three weeks, saying an attacker stole about $3.27 million in crypto assets after compromising its cloud infrastructure.
Initia said the attacker gained unauthorized access on Monday through a command injection attack involving a compromised Google Cloud Platform key, and the breach exposed environment variables that enabled access to its GitHub and cloud accounts.
Initia said the attacker accessed Anvil, a platform hosting rollups, and validated fraudulent Inter-Blockchain Communication withdrawals from five rollups, releasing assets held in the network's escrow accounts.
Initia said about $2.16 million of the stolen assets remain frozen on its halted network, and it said it halted its layer-1 on Tuesday.
Initia said the incident followed an Oct. 23 exploit in which an attacker drained about $2.7 million by exploiting a vulnerability in its MoveVM script cache.
How the attacker moved
Initia described the breach as extending beyond a single service, saying the attacker could view environment variables and use them to obtain additional credentials.
Initia said the attacker validated fraudulent Inter-Blockchain Communication (IBC) withdrawals from five rollups, triggering withdrawals of assets held in Initia's escrow accounts.
Initia said it sold assets on its decentralized exchange and withdrew 13,400 TIA, 8,000 USDC, and 597,000 Noble USDC, while it said no INIT tokens were withdrawn.
Initia said it intends to restore the backing of affected assets, and it said recovery efforts are ongoing with law enforcement and security partners.
Shattered.io framed the earlier Oct. 23 incident as a MoveVM flaw that let an attacker mint unbacked balances, and it said that halt stopped the L1 and every rollup on October 23.
What happens next
Initia said the network halt left about $2.16 million frozen because it halted the layer-1, and it said the company is rebuilding its infrastructure while planning to fully restore affected assets. Pluang said no restart date had been announced, while it described the breach as a Google Cloud key compromise that allowed an attacker to access systems and validate fake withdrawals. Initia said it plans to restore the backing of affected assets, and it said recovery efforts are ongoing with law enforcement and security partners.
Shattered.io said the October bug lived in code and that an audited patch addressed it, while it said the November incident involved keys and that a patch cannot fix a key that an attacker already holds. Shattered.io also said a separate disclosure circulating on November 9 and 10 cited a figure near $3.27 million, and it said the conservative reading is that the second incident involved at least $615,000 and that the final total is unsettled.