initia second exploit: GCP Key Abuse Drains $3.27M, L1 Halted
The initia second exploit in under three weeks used a compromised Google Cloud key to forge withdrawals from five rollups and move about $3.27M; the L1 was halted Nov 10 and about $2.16M is stuck.
- The entry point was a command-injection attack using a GCP key meant for provisioning private nodes, per Initia's own thread.
- The Initia L1 was halted at 06:18 UTC on November 10 in coordination with validators; no restart date has been given.
- This follows an October 23 exploit in which an attacker drained about $2.7M through a MoveVM bug.
The initia second exploit in under three weeks has the layer-1 halted again and its team rebuilding infrastructure from scratch. Initia says an attacker used a compromised Google Cloud key to reach its rollup hosting platform, forged withdrawals from five rollups, and moved about $3.27M of bridged assets. Roughly $2.16M of that is stuck on the paused chain, and the project says it intends to restore the backing of affected assets in full.
What actually happened
The first sign came on the evening of November 9 UTC. Initia posted on X that it was investigating "an issue affecting rollup infrastructure" and had coordinated with rollups to pause. At that point it said it had not identified any impact on user funds and the L1 was still live.
That changed overnight. Early on November 10, Initia halted the L1 after spotting unauthorized transfers from the escrow accounts that hold assets bridged to its rollups. Later that day it published the full picture, and said asset recovery efforts are ongoing with the help of law enforcement and security partners.
How the attack worked
According to Initia's thread, the chain of failures looked like this:
- On November 9, an attacker got into Initia's infrastructure through command injection with a compromised GCP key used for private-node provisioning.
- That exposed environment variables, which handed over access to Initia's GitHub and Google Cloud accounts plus more credentials.
- With those, the attacker reached Anvil, the hosting platform rollups on Initia use.
- From Anvil, the attacker validated forged IBC withdrawals from five rollups, unlocking assets held in the L1's IBC escrow accounts.
About $3.27M moved to the attacker's L1 address. The attacker sold some assets on the Initia DEX and withdrew about 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC before hitting Initia's outbound IBC rate limits. No INIT left the chain. Initia's figures imply that roughly $1.1M got out, by our own math; the project has not published that exact number.
This is not a smart contract bug
That is the uncomfortable part. Cointelegraph and CoinMarketCap both relay Initia's account that the breach started in cloud credentials, not in on-chain code. Rate limits on IBC outflows appear to be what capped the damage, and the halt froze most of the rest. Initia says it is rebuilding the affected infrastructure in an isolated environment, enforcing least-privilege access, and hardening "every layer of the stack," and that this will take longer than a routine restart.
Why the initia second exploit stings
Three weeks ago, on October 23, Cointelegraph reported that an attacker exploited a vulnerability in Initia's MoveVM script cache to create unbacked balances and bridge out about $2.7M. We covered that first halt in initia network halt. Two incidents with two completely different root causes in such a short window is a rough look for any chain trying to win builders and liquidity.
The pattern also echoes this week's across domain hijack, where the weak point was off-chain infrastructure rather than contracts. Attackers are going after keys, domains and cloud accounts because that is often easier than breaking audited code.
Bridged assets are only as safe as the weakest credential in the stack that validates them.
What to do as a reader
If you hold assets on Initia or its rollups:
- Do not panic-sign anything. During halts, phishing links pretending to be "recovery portals" are common. Initia says all announcements will come through its official channels.
- Wait for the restoration plan. Initia says it is finalizing how it will restore backing for affected assets and will share details once confirmed.
- Check what you actually hold. Affected assets are bridged tokens held via IBC escrow; Initia says no INIT was withdrawn by the attacker.
- Price in operational risk. For chains with multiple incidents in a month, treat yields and points programs with extra suspicion.
The initia second exploit is still developing, and the final loss figure could change. Nothing here is financial advice.
Not financial advice. DYOR, ser.
