Binance Labs-backed Initia confirms second exploit in three weeks

What happened

Initia has confirmed that it suffered a second security breach in less than three weeks, after an attacker obtained access through compromised cloud infrastructure. In a Wednesday statement, the layer-1 blockchain said unauthorized access began on Monday and involved a command injection technique that used a compromised Google Cloud Platform key. The breach exposed environment variables, according to Initia, which then allowed the attacker to reach the project's GitHub and cloud accounts and collect additional credentials.

The attacker used that access to reach Anvil, a platform that hosts rollups, and to validate fraudulent Inter-Blockchain Communication withdrawals from five rollups, Initia said. That released assets held in escrow accounts. The network was halted on Tuesday as a protective step, and Initia said about $2.16 million of the stolen assets remained frozen on the stopped chain. The attacker sold assets on Initia's decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC, according to Cointelegraph. No INIT tokens were withdrawn. Initia said it is working with law enforcement and security partners on recovery.

Protos reported that the chain was halted at 06:18 UTC on November 10, in coordination with validators, after unauthorized transfers from escrow accounts holding bridged assets. The outlet said the team initially counted at least $615,000 that had moved off-chain, while most of the assets removed from escrow remained on Initia and might be recoverable through validator coordination. Cointelegraph later reported the larger $3.27 million total and the $2.16 million frozen figure.

Why it matters

The second incident in a short period raises questions about operational security and bridge escrow design at a time when Initia is trying to restore confidence. Protos reported that the combined losses from the two incidents are greater than Initia's remaining total value locked, which it said is down more than 90% from its peak shortly after the network launched in May last year. The halt also affects rollups that depend on the layer-1 for bridged assets, and the team's promise to restore backing for affected assets will be a key test. Reactions cited by Protos included users calling for the chain to shut down and accusing the team of an inside job; those accusations have not been substantiated in the reports.

What the data shows

Reported figures vary by timing and scope. Cointelegraph put the latest theft at about $3.27 million and said roughly $2.16 million remained frozen. Protos said at least $615,000 initially left the chain and that the two incidents together amount to more than $3.3 million. The October loss was about $2.7 million. Cointelegraph listed the withdrawn assets as 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC, and said no INIT was taken. Protos also noted that INIT's price was up around 60% over the prior 24 hours, which it said prompted suspicions among frustrated users of a so-called crime pump.

Background

The earlier exploit occurred on October 23 and involved a vulnerability in Initia's MoveVM script cache, according to Cointelegraph. Malicious code was able to bypass security checks and create unbacked token balances that were then bridged out of the network, leading to about $2.7 million in losses. Initia halted the chain and its rollups after that incident, and they came back online on November 2 before the new breach eight days later, Protos reported. Initia, which counts Binance Labs, Delphi Ventures and HackVC among its backers, describes itself as a base layer and central liquidity hub for Interwoven Rollups.

What is still unclear

The reports do not fully reconcile the initial $615,000 off-chain figure with the later $3.27 million total, and it is not clear how much of the frozen $2.16 million can be recovered or when. The attacker's identity has not been disclosed, and the reports do not say whether any funds beyond the frozen amount have been returned. It is also unclear how the incident will affect the rollups that rely on the affected escrow accounts.

What to watch

Users will be watching validator coordination to see whether the frozen assets are released or burned, and whether Initia can restore backing for affected bridged assets. The team's work with law enforcement and security partners, the restart of the halted network, and any further disclosure about the compromised cloud credentials are also points to follow. Protos reported that the incident has already prompted aggressive reactions, so communication from the team will matter as much as the technical recovery.

Questions readers ask