Initia Hit by Second Exploit in Less Than Three Weeks

Layer-1 blockchain Initia confirmed its second security exploit in less than three weeks after an attacker stole about $3.27 million in crypto assets through compromised cloud infrastructure, Cointelegraph reported on 11 November. The breach forced Initia to halt its network for the second time since an October incident that drained $2.7 million. The attacker gained unauthorized access on 9 November through a command injection attack involving a compromised Google Cloud Platform (GCP) key, Cointelegraph reported. The breach exposed environment variables that gave the attacker access to Initia’s GitHub and cloud accounts, allowing them to obtain additional credentials. The attacker used those credentials to reach Anvil, a platform that hosts rollups, and validated fraudulent Inter-Blockchain Communication (IBC) withdrawals from five rollups.