Initia discloses attack path, approximately $3.27 million in assets transferred to attacker's address

On November 11, Initia disclosed that on November 9, attackers exploited leaked GCP keys to access its infrastructure via command injection, subsequently gaining GitHub and GCP accounts along with other credentials. They obtained access to Anvil, a rollup hosting platform, and validated forged IBC withdrawals from five rollups.

Approximately $3.27 million in assets were transferred to the attacker's Initia L1 address, with about $2.16 million remaining on the paused network. After selling the stolen assets, the attacker withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC, without withdrawing any INIT from Initia.

Initia stated it intends to fully restore support for the affected assets and rebuild the impacted infrastructure in an isolated environment, estimating that the process will take longer than a standard network restart.