Initia's second hack in 18 days started with one leaked cloud key, not a smart-contract bug.
Per Initia's own post-mortem (via Cointelegraph):
1. Entry: a compromised Google Cloud key for provisioning private nodes, used in a command injection on Nov 9. That exposed its GitHub and cloud accounts.
2. Reach: the attacker got into Anvil, the rollup-hosting platform, and validated forged IBC withdrawals from five rollups.
3. Damage: about $3.27M moved to the attacker, $2.16M still frozen on the halted L1. No INIT was withdrawn.
The Oct 23 exploit (about $2.7M) was a MoveVM script cache flaw, so this is a different failure class. My read: audits cover code, but a leaked credential walks around them. A restart means rebuilding infrastructure in isolation, with no date given, and Initia says it intends to restore affected assets in full.
Which matters more when you size up a chain: code audits or key management? $INIT $TIA
#Initia #Security #Hacks
Disclosure: I can earn Binance Write to Earn rewards from this post.
Per Initia's own post-mortem (via Cointelegraph):
1. Entry: a compromised Google Cloud key for provisioning private nodes, used in a command injection on Nov 9. That exposed its GitHub and cloud accounts.
2. Reach: the attacker got into Anvil, the rollup-hosting platform, and validated forged IBC withdrawals from five rollups.
3. Damage: about $3.27M moved to the attacker, $2.16M still frozen on the halted L1. No INIT was withdrawn.
The Oct 23 exploit (about $2.7M) was a MoveVM script cache flaw, so this is a different failure class. My read: audits cover code, but a leaked credential walks around them. A restart means rebuilding infrastructure in isolation, with no date given, and Initia says it intends to restore affected assets in full.
Which matters more when you size up a chain: code audits or key management? $INIT $TIA
#Initia #Security #Hacks
Disclosure: I can earn Binance Write to Earn rewards from this post.