Initia said a compromised cloud credential let attackers move about $3.27 million to attacker addresses through forged withdrawals on five rollups, leading the project to pause its Layer 1.
After selling assets on Initia’s decentralized exchange, attackers withdrew 8,000 USDC.inj, 597,000 Noble USDC and 13,400 TIA, the project said. Initia said its native token, INIT, was not transferred.
Initia said about $2.16 million in stolen assets remained immobile on its paused Layer 1. An earlier estimate put transfers through Noble before the pause at about $605,000 in USD Coin (USDC) and $10,000 in other tokens. Initia said most assets transferred from escrow remained on its paused Layer 1, as detailed in our initial account of the transfers.
Initia said it plans to restore all affected assets, with work on impacted systems taking place in an isolated environment. The project said a regular restart would be quicker than the rebuild, while law enforcement and security partners are assisting the recovery.
The intrusion occurred Nov. 9, and the network pause followed Nov. 10. Initia attributed the breach to command injection that exploited a leaked Google Cloud Platform (GCP) key used to configure private nodes.
The project said attackers accessed its systems and accounts at GitHub and Google Cloud, plus other credentials and the Anvil service used for rollups. Initia said access to Anvil let attackers forge Inter-Blockchain Communication (IBC) withdrawals on five rollups, releasing assets from Layer 1 escrow.
Those escrow accounts held assets as they moved between rollups. Initia said it coordinated with validators before pausing the Layer 1 at 1:18 a.m. ET (6:18 UTC) Nov. 10 to protect the network while it reviewed the incident. Its security team, validators and exchanges were helping assess the scope, the project said.
