Initia confirms second exploit in three weeks, says $3.27M taken via cloud breach
In brief
- Initia confirmed on Wednesday its second security exploit in less than three weeks.
- An attacker took about $3.27 million after compromising Initia's cloud infrastructure, the company said.
- About $2.16 million of the stolen assets remains frozen on the halted network, Initia said.
- An earlier Oct. 23 exploit drained about $2.7 million through a MoveVM script cache flaw.
How Initia says the attacker got in
Initia said the attacker gained unauthorized access on Monday through a command injection attack involving a compromised Google Cloud Platform key. That was the entry point. The company said the breach exposed environment variables, which let the attacker reach Initia's GitHub and cloud accounts and pull more credentials.
Then came the rollups.
According to Initia, the attacker accessed Anvil (a platform that hosts rollups) and validated fraudulent Inter-Blockchain Communication (IBC) withdrawals from five rollups, which released assets held in escrow accounts. The attacker then sold assets on Initia's decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC, per the company's statement as reported by Cointelegraph. No INIT tokens were withdrawn.
Network halted while recovery continues
Initia halted its layer-1 on Tuesday. It's said it intends to restore the backing of affected assets, which means that's still a plan rather than a finished fix. The company also said recovery efforts are ongoing with its law enforcement and security partners.
Of the $3.27 million taken, Initia put the frozen portion at about $2.16 million, held on the halted network.
The second incident since Oct. 23
This week's breach wasn't Initia's first. Cointelegraph reported that in an Oct. 23 exploit, an attacker drained about $2.7 million by exploiting a vulnerability in Initia's MoveVM script cache. That flaw let malicious code bypass security checks and create unbacked token balances, which were later bridged out of the network.
The October attack exploited a code vulnerability. By Initia's own account, this week's started with a compromised cloud key, and it didn't stop there: the attacker used the credentials it found to get into GitHub, the cloud accounts and Anvil.
Frequently asked questions
How did the attacker get into Initia's systems?
Initia said the attacker gained access on Monday through a command injection attack involving a compromised Google Cloud Platform key. The breach exposed environment variables, which let the attacker reach Initia's GitHub and cloud accounts and obtain more credentials.
How much did Initia lose and how much is frozen?
Initia said an attacker took about $3.27 million in crypto assets, according to Cointelegraph. The company said about $2.16 million of those assets remains frozen on its halted network, and no INIT tokens were withdrawn.
What happened in Initia's earlier Oct. 23 exploit?
Cointelegraph reported that an attacker drained about $2.7 million on Oct. 23 by exploiting a vulnerability in Initia's MoveVM script cache. The flaw let malicious code bypass security checks and create unbacked token balances, which were later bridged out of the network.
