Initia halts its blockchain again after an attacker uses a stolen cloud key to forge withdrawals worth about $3.27 million

Initia has stopped its blockchain for the second time in less than three weeks. The project halted its layer-1 network at 06:18 UTC on November 10 after spotting unauthorized transfers out of escrow accounts, CoinCentral and Grafa reported, and on Wednesday it put the total taken at about $3.27 million. Its first estimate had been about $615,000, CoinCentral said.

According to Initia's account, the attacker got in on November 9 through a command injection attack using a compromised Google Cloud Platform key that was used to set up private nodes. Exposed environment variables gave access to Initia's GitHub and cloud accounts and to Anvil, the platform that hosts its rollups. The attacker then approved forged cross-chain (IBC) withdrawals from five rollups, releasing assets held in escrow, and took TIA, USDC and other tokens. About $2.16 million of the stolen assets remains frozen on the halted network, and no INIT tokens were withdrawn.

Initia said on X that it intends "to restore the backing of affected assets in full." It has not said when the chain will restart. In October an attacker used a flaw in Initia's MoveVM script cache to create unbacked token balances and bridge out about $2.7 million; the network came back on November 2 after a patch, CoinCentral reported.