Initia Hit by Second Exploit in Three Weeks: $3.27M Stolen

Initia has been exploited for the second time in three weeks, with the team saying an attacker moved about $3.27M of assets. The project disclosed the incident on X on Nov. 10 at 11:43 AM ET.

Details

According to Initia, on Nov. 9 an attacker gained access to its infrastructure through a command injection attack that used a compromised Google Cloud (GCP) key for provisioning private nodes. That exposed environment variables, which led to the team's GitHub and GCP accounts and further credentials. The attacker then reached Anvil, the hosting platform for Initia rollups, and validated forged IBC withdrawals from five rollups, unlocking assets in the Initia L1's IBC escrow accounts.

About $3.27M moved to the attacker's address on the L1, and $2.16M of it remains on the paused chain, where it cannot be moved. The attacker sold the rest on the Initia DEX and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC before hitting outbound IBC rate limits. No INIT was withdrawn.

The L1 was halted at 06:18 UTC on Nov. 10 (1:18 AM ET) in coordination with validators, Initia said earlier, citing roughly $605,000 USDC that left via Noble plus $10,000 in other tokens at that point. The first exploit came on Oct. 23, when an attacker minted tokens without limit; we covered it here.

What this means for the market

Initia says it intends to restore the backing of affected assets in full and is rebuilding the affected infrastructure from scratch in an isolated environment, so the restart will take longer than a routine one. A compensation plan has not been published yet. The attack path, from a cloud key to rollup hosting, shows that bridge and rollup risk sits in infrastructure and key management as well as in smart contracts. For background on the first incident, see our Initia hack explainer.

Full timeline — in our explainer.