Initia hit by $3.27M crypto breach

Initia disclosed Wednesday that compromised cloud credentials enabled an attacker to extract approximately $3.27 million in digital assets, marking the platform's second breach in under three weeks.

The unauthorised entry occurred Monday when the attacker deployed a command injection method against a Google Cloud Platform key. Environment variables leaked during the intrusion gave the attacker pathways into Initia's GitHub repositories and cloud infrastructure, yielding further credentials.

Using those credentials, the attacker reached Anvil — the rollup-hosting platform — and approved fraudulent Inter-Blockchain Communication withdrawals across five rollups, triggering the release of funds from escrow accounts. The attacker then liquidated positions on Initia's decentralised exchange and moved 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC off the network. INIT tokens were not among the withdrawn assets.

Around $2.16 million of the drained total remains locked on Initia's layer-1, which the team halted Tuesday. Initia stated it will restore backing for impacted assets and continues working with law enforcement and security specialists on recovery.

Three weeks earlier, on Oct. 23, a separate attacker drained roughly $2.7 million by exploiting a flaw in Initia's MoveVM script cache. That vulnerability allowed malicious scripts to evade validation, mint unbacked token balances and bridge them out before detection.