Initia, a layer-1 blockchain network, has confirmed its second security breach in just three weeks. On Wednesday, the platform revealed that an attacker exploited compromised cloud credentials to steal approximately $3.27 million in crypto assets. The attack occurred on Monday through a command injection attack involving a compromised Google Cloud Platform key. This breach exposed environment variables, allowing the attacker to access Initia’s GitHub and cloud accounts and obtain additional credentials.
The attacker targeted Anvil, a platform hosting rollups, and validated fraudulent Inter-Blockchain Communication (IBC) withdrawals from five rollups. This action released assets held in the network’s escrow accounts. Initia reported that about $2.16 million of the stolen assets remain frozen on its halted network. The attacker sold assets on Initia’s decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC. No INIT tokens were withdrawn.
Initia halted its layer-1 network on Tuesday and stated its intention to restore the backing of affected assets. The blockchain said recovery efforts are ongoing with its law enforcement and security partners. This incident follows an earlier exploit on October 23, where an attacker drained about $2.7 million by exploiting a vulnerability in Initia’s MoveVM script cache. That breach allowed malicious code to bypass security checks and create unbacked token balances that were subsequently bridged out of the network.