Skip to the article
Crypto Daybook

Markets, chains and policy news

Initia Details $3.27M Exploit After Halting Its Chain

Initia says compromised cloud access led to $3.27 million in stolen assets, with $2.16 million frozen on its halted chain as it works to restore backing.

Crypto Daybook Newsroom2 min read

Initia Details $3.27M Exploit After Halting Its Chain

Initia says an attacker stole about $3.27 million in crypto assets, prompting the project to halt its layer-1 blockchain on Nov. 10; about $2.16 million remains frozen on the network. The updated figure is much higher than the roughly $615,000 reported in the first hours of the incident. Initia’s account of the halt and initial transfers was reported by crypto.news; its later investigation found a broader breach.

How did the attacker reach Initia’s escrow accounts?

According to Cointelegraph’s report on Initia’s investigation, the attacker used a compromised Google Cloud Platform key in a command injection attack on Nov. 9. The breach exposed environment variables and gave the attacker access to Initia’s GitHub and cloud accounts, along with more credentials.

The attacker then accessed Anvil, a platform that hosts rollups, and approved false Inter-Blockchain Communication (IBC) withdrawals from five rollups. IBC is a system that lets separate blockchains transfer assets between them. The withdrawals released assets held in Initia’s escrow accounts.

Initia coordinated with validators to halt its layer-1 chain the following day. The pause stopped block production while the team investigated the transfers.

How much remains on the halted network?

Initia said about $2.16 million of the stolen assets remains frozen on the halted chain. The attacker also sold assets on Initia’s decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC, Cointelegraph reported. The project said no INIT tokens were withdrawn.

Initia said it plans to restore full backing for the affected assets, and that recovery work is continuing with law enforcement and security partners. The company has not said when the network will resume operations.

The breach was Initia’s second security exploit in less than three weeks. On Oct. 23, an attacker exploited a flaw in the project’s MoveVM script cache, creating unbacked token balances; about $2.7 million was later moved out of the network.

During the first reports of the November incident, INIT rose more than 60% over 24 hours, according to market data cited by crypto.news. That price move does not explain the cause of the exploit or indicate when the halted network will reopen.

References