Initia says second exploit in under three weeks stole $3.27 million

Initia said an attacker stole about $3.27 million in crypto assets in the blockchain's second disclosed exploit in less than three weeks, according to the company. The layer-1 network confirmed the loss Wednesday and said about $2.16 million of the stolen assets remains frozen while the chain is halted.

How did the attacker breach Initia?

Initia said the attacker gained unauthorized access Monday through a command injection attack involving a compromised Google Cloud Platform key. The breach exposed environment variables, giving the attacker access to Initia's GitHub and cloud accounts and allowing the theft of additional credentials, the company said. The disclosure did not explain how the Google Cloud key was compromised.

The attacker then accessed Anvil, a platform hosting rollups, Initia said. At Anvil, the attacker validated fraudulent Inter-Blockchain Communication (IBC) withdrawals from five rollups. Those transactions released assets held in the network's escrow accounts, according to Initia.

The disclosed path crossed several layers of Initia's infrastructure: a Google Cloud Platform key, exposed environment variables, credentials in GitHub and cloud accounts, and the rollup-hosting environment at Anvil. That sequence moved the incident from cloud configuration to the system used to host rollups and validate cross-chain withdrawals, widening the operational exposure beyond a single account.

What did the attacker withdraw?

Initia said the attacker sold assets on Initia's decentralized exchange and then withdrew:

• 13,400 TIA
• 8,000 USDC.inj
• 597,000 Noble USDC

No INIT tokens were withdrawn, Initia said. The disclosed outflow comprised three non-INIT assets, based on the withdrawals Initia listed. The company did not state the dollar value of each withdrawal or identify the five rollups, so the report does not tie the token totals to individual rollup balances.

About $2.16 million of the stolen assets remains frozen on the halted network, according to Initia. The frozen balance covers most of the reported $3.27 million theft. Initia said “recovery efforts are ongoing with its law enforcement and security partners.”

The statement identifies law-enforcement and security partners as participants in the work but provides no partner names, case numbers or timetable for asset recovery.

Why did Initia halt its layer-1?

Initia halted its layer-1 on Tuesday, one day before Wednesday's confirmation. The company said it “intends to restore the backing of affected assets.” That statement makes restoration of asset backing the company's stated post-halt objective. Initia did not publish a restart date in the disclosure.

For users of the five affected rollups, the immediate consequence is uncertainty over settlement and the recovery of assets released from escrow. Initia's halt keeps normal chain processing suspended while recovery work continues, leaving the frozen balance under network control.

How does this compare with the Oct. 23 exploit?

The latest incident follows an Oct. 23 exploit that drained about $2.7 million from Initia. According to the company, the earlier attacker exploited a vulnerability in the MoveVM script cache. That flaw allowed malicious code to bypass security checks and create unbacked token balances, which the attacker subsequently bridged out of the network.

The two incidents used distinct paths: compromised cloud credentials and fraudulent IBC withdrawals in the latest case, and a MoveVM script-cache vulnerability in October. The earlier exploit created unbacked balances inside the network before bridging them out; the latest attack released assets already held in network escrow accounts.

Operationally, the repeat loss broadens Initia's remediation beyond a single contract or rollup. The company must secure cloud and repository credentials, review permissions around rollup hosting and re-establish escrow backing before normal settlement resumes.

The next checkpoint is whether Initia can preserve the $2.16 million freeze and restore backing for the affected assets before lifting the layer-1 halt; the company disclosed no restart deadline.