Initia Says Cloud Breach Enabled $3.27 Million in Rollup Transfers

Initia said a compromised cloud key let an attacker validate forged withdrawals from five rollups, moving about $3.27 million to an Initia Layer 1 address before the network was halted.

About $2.16 million of those assets remained on the paused Layer 1 and could not be moved, Initia said in a Nov. 10 update. The network halted after unauthorized transfers from escrow accounts were found.

Initia traced the Nov. 9 intrusion to command injection involving a compromised Google Cloud Platform key used to provision private nodes. The breach exposed environment variables, giving the attacker access to Initia’s GitHub and cloud accounts, credentials and Anvil, its rollup hosting platform, the company said.

With that access, Initia said, the attacker validated forged Inter-Blockchain Communication (IBC) withdrawals from escrow accounts tied to five rollups. The attacker sold assets on Initia’s decentralized exchange, then made withdrawals that reached the network’s outbound IBC rate limits. Initia said no INIT was withdrawn.

Initia plans to restore backing for affected assets and is rebuilding infrastructure in an isolated environment. It gave no restart date. The network and rollups had returned from a separate October outage on Nov. 2.