Initia halted its layer 1 after an attacker used a compromised cloud key to forge withdrawals from five rollups, moving $3.27M, with $2.16M still frozen.
Key Facts
Initia halted its layer-1 network at 06:18 UTC on Nov. 10 after unauthorized transfers from escrow accounts holding assets bridged to its rollups.
Initia said an attacker used a compromised cloud key to reach its infrastructure, forged withdrawals from five rollups and moved about $3.27 million, with $2.16 million still on the paused chain.
Initia, whose network was also halted on Oct. 23, said it intends to restore the backing of affected assets in full.
Initia (INIT) said an attacker moved about $3.27 million out of escrow accounts on its layer-1 network, prompting it to halt the chain for the second time since late October.
The network was halted at 06:18 UTC on Nov. 10 in coordination with validators, after Initia identified unauthorized transfers from the escrow accounts that hold assets bridged to its rollups. About $2.16 million of the stolen funds remain on the paused chain, where they cannot be moved, Initia said.
"We intend to restore the backing of affected assets in full," Initia said in an X post, adding that it is finalizing the plan.
INIT more than doubled and then gave back its gains as the Initia breach and network halt unfolded. Source: CoinMarketCap
How the Attack Worked
On Nov. 9, an attacker gained access to Initia's infrastructure through a command injection attack using a compromised Google Cloud Platform key for provisioning private nodes, Initia said. That exposed environment variables, which let the attacker into its GitHub and Google Cloud accounts and gave it further credentials.
The attacker then reached Anvil, the hosting platform used by rollups on Initia, and validated forged Inter-Blockchain Communication withdrawals from five rollups. That unlocked assets held in the layer 1's escrow accounts, Initia said.
The attacker sold stolen assets on the Initia DEX and withdrew about 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC before hitting outbound rate limits. No INIT was withdrawn, Initia said.
Rebuild and Second Halt
Initia said it is rebuilding the affected infrastructure from scratch in an isolated environment and expects the process to take longer than a routine network restart. Asset recovery efforts after the hacking incident are ongoing with law enforcement and security partners, it said.
Initia previously halted its layer 1 and rollups on Oct. 23 after a security incident. In August, Cronos paused its network after a $75 million exploit of lending protocol Tectonic.
INIT more than doubled from about $0.13 on Nov. 9 to about $0.30 early on Nov. 11 before falling back, CoinMarketCap data showed. It traded at $0.147 on Wednesday evening UTC, down 45% over 24 hours.
This article contains links to third-party websites or other content for information purposes only ("Third-Party Sites"). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author's [company's] own and do not necessarily reflect those of CoinMarketCap.
