Initia halts its network after a $3.27 million breach that began with a compromised Google Cloud key

Initia, a layer-1 blockchain that hosts a network of smaller "rollup" chains, halted its main network on November 10 after an attacker used stolen credentials to move about $3.27 million of assets, the project said on X. About $2.16 million of that is stuck on the paused network, Initia said, adding that it intends to make the affected assets fully backed again.

How the Initia exploit worked, according to the project

Initia said that on November 9 the attacker exploited a command injection flaw using a compromised key for Google Cloud Platform (GCP) that was used to set up private nodes. That exposed environment variables, the settings a program reads when it starts, which let the attacker into Initia's GitHub and GCP accounts and to more credentials.

Those credentials gave access to Anvil, the service that hosts Initia's rollups. Through it, the attacker validated forged withdrawals over IBC, the protocol that moves tokens between these chains, from five rollups. That unlocked assets held in escrow accounts on Initia's main chain, Initia said.

The attacker sold some of the assets on Initia's own decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 USDC via Noble before reaching the network's outbound transfer limits, according to Initia. No INIT tokens were withdrawn, Initia said.

How the incident unfolded

At 19:30 UTC on November 9, Initia said it was investigating an issue with rollup infrastructure and had arranged with the rollups to pause them temporarily, adding that it had not identified any impact on user funds. Early on November 10, it halted its main chain with its validators after finding unauthorized transfers from the escrow accounts, and put the amount that had left through Noble at about $605,000 in USDC. Its later update put the total moved to the attacker's address on Initia's main chain at about $3.27 million.

Initia said it is rebuilding the compromised systems from the ground up, walled off from the rest of its setup, and limiting each account to the access it strictly needs. It said bringing the main chain back will take longer than a routine restart. It said it will share the recovery plan once it is final and give timelines when it has them.

Why it matters

This is Initia's second security incident in less than three weeks. An October 23 exploit of a flaw in the network's MoveVM script cache let an attacker take about $2.7 million, Cointelegraph reported. Initia resumed operations after that incident on November 2, a week before the new breach.

Unlike that exploit, which targeted code on the chain, this one went through the cloud and developer accounts behind it. Off-chain weak points have featured in several recent incidents: attackers redirected DeFi websites registered with Name.com on October 31, and this week Across Protocol said an attacker had hijacked its website domain through its registrar.

What it could mean for users

Initia had not announced a restart of its main chain as of November 11. That chain holds the escrow accounts behind assets bridged to its rollups, and Initia says the roughly $2.16 million that reached the attacker's address there cannot be moved. Initia has said it intends to make the affected assets fully backed again, but as of November 11 it had not published that plan or a restart date. It has warned users to be wary of unofficial links and messages and says it will post updates only on its official accounts.