Initia: Attack Stemmed From Leaked GCP Key, About $3.27 Million in Assets Moved Out

November 11: Initia posted on X disclosing progress in its security incident investigation, stating that on November 9 an attacker exploited a leaked GCP key (used to configure private nodes) to gain unauthorized access to Initia's infrastructure via a command injection attack, then obtained its GitHub and GCP accounts and additional credentials, and gained access to Rollup hosting platform Anvil, using it to forge IBC withdrawals for 5 Rollups and unlock assets in Initia L1's IBC escrow accounts. About $3.27 million in assets was transferred to the attacker's address, while another $2.16 million in stolen funds remains on the paused L1 and cannot be moved.

After selling the stolen assets on the Initia DEX, the attacker withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC, and did not move out any INIT. Initia said it plans to fully restore the affected assets and will rebuild its infrastructure in an isolated environment, expecting the restart to take longer than a regular network restart; asset recovery efforts are still underway with the assistance of law enforcement and security partners. As previously reported, the Initia L1 was halted at 14:18 on November 10.