Initia Discloses Attack Path; About $3.27 Million in Assets Transferred to Attacker Address

As reported by TechFlow on November 11, Initia disclosed that the attacker used leaked GCP keys on November 9 to access its infrastructure via command injection, subsequently obtained GitHub, GCP accounts, and other credentials, and gained access to the Rollup hosting platform Anvil, validating forged IBC withdrawals from five Rollups.

About $3.27 million in assets were transferred to the attacker's Initia L1 address, of which about $2.16 million remained on the paused network. After selling the stolen assets, the attacker withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC, and did not withdraw INIT from Initia.

Initia stated that it plans to support the full recovery of affected assets and rebuild the affected infrastructure in an isolated environment, which is expected to take longer than a normal network restart.

Source: TechFlow