When it comes to key leaks, the biggest fear isn’t losing money—it’s losing control.
Initia officially disclosed that on November 9, an attacker used a leaked GCP key (originally intended to configure a private node) to carry out command injection and gain access to Initia’s infrastructure. The attacker obtained GitHub and GCP accounts, along with other credentials, and gained access to Anvil, the Rollup hosting platform. They then forged IBC withdrawals for five Rollups, unlocking funds in Initia L1’s IBC escrow accounts. Approximately $3.27 million has been transferred to the attacker’s address, while another $2.16 million is trapped on the paused L1 and cannot be moved. After selling the stolen assets on Initia DEX, the attacker withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC, but did not transfer out any INIT. The outlook is bearish. The core issue with this kind of vulnerability isn’t the loss from a single transaction, but the fact that key management and the custody layer were compromised in one breach. Anvil is a critical link in Rollup asset custody; leaking its credentials effectively gives an attacker both validation privileges and an exit for funds, directly bypassing the security assumptions of IBC cross-chain custody. The L1 was paused quickly, freezing the $2.16 million and showing that there is still some room to respond, but the chances of recovering the $3.27 million already transferred are limited.
Initia said it plans to fully restore the affected assets and will rebuild its infrastructure in an isolated environment. The restart is expected to take longer than a routine network restart. Efforts to recover the assets are ongoing with assistance from law enforcement and security partners. As previously reported, Initia L1 was paused at 14:18 on November 10.
INIT holders and cross-chain users should keep an eye on three things: when and under what conditions the L1 and IBC channels will resume; whether the team will publicly disclose a compensation or fund recovery plan; and whether Anvil’s key rotation and privilege isolation are actually implemented. If the team only issues announcements without providing details on how the funds will be handled, the trust discount on INIT and related Rollup assets will persist. Any rebound will depend more on the broader BTC market than on the project’s own narrative, so it’s worth waiting until the risk exposure is clear before considering a dip-buying opportunity.
Two scenarios to watch: First, if details on how the funds will be handled are provided alongside the resumption of the L1 and IBC channels, there will be a basis for restoring trust. Second, if there are only announcements without a compensation or recovery plan, the trust discount on INIT and related Rollup assets may persist. Which would you like to see first—the conditions for resuming the channels, or a plan for handling the funds?
Source: PANews
$INIT
Image 1: Initia hit by an attack exploiting a leaked GCP key; approximately $3.27 million stolen · Screenshot of source page
Image source: https://www.panewslab.com/zh/articles/01a1c708-dbb5-7433-acd3-32a44f3b899a
Initia officially disclosed that on November 9, an attacker used a leaked GCP key (originally intended to configure a private node) to carry out command injection and gain access to Initia’s infrastructure. The attacker obtained GitHub and GCP accounts, along with other credentials, and gained access to Anvil, the Rollup hosting platform. They then forged IBC withdrawals for five Rollups, unlocking funds in Initia L1’s IBC escrow accounts. Approximately $3.27 million has been transferred to the attacker’s address, while another $2.16 million is trapped on the paused L1 and cannot be moved. After selling the stolen assets on Initia DEX, the attacker withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC, but did not transfer out any INIT. The outlook is bearish. The core issue with this kind of vulnerability isn’t the loss from a single transaction, but the fact that key management and the custody layer were compromised in one breach. Anvil is a critical link in Rollup asset custody; leaking its credentials effectively gives an attacker both validation privileges and an exit for funds, directly bypassing the security assumptions of IBC cross-chain custody. The L1 was paused quickly, freezing the $2.16 million and showing that there is still some room to respond, but the chances of recovering the $3.27 million already transferred are limited.
Initia said it plans to fully restore the affected assets and will rebuild its infrastructure in an isolated environment. The restart is expected to take longer than a routine network restart. Efforts to recover the assets are ongoing with assistance from law enforcement and security partners. As previously reported, Initia L1 was paused at 14:18 on November 10.
INIT holders and cross-chain users should keep an eye on three things: when and under what conditions the L1 and IBC channels will resume; whether the team will publicly disclose a compensation or fund recovery plan; and whether Anvil’s key rotation and privilege isolation are actually implemented. If the team only issues announcements without providing details on how the funds will be handled, the trust discount on INIT and related Rollup assets will persist. Any rebound will depend more on the broader BTC market than on the project’s own narrative, so it’s worth waiting until the risk exposure is clear before considering a dip-buying opportunity.
Two scenarios to watch: First, if details on how the funds will be handled are provided alongside the resumption of the L1 and IBC channels, there will be a basis for restoring trust. Second, if there are only announcements without a compensation or recovery plan, the trust discount on INIT and related Rollup assets may persist. Which would you like to see first—the conditions for resuming the channels, or a plan for handling the funds?
Source: PANews
$INIT
Image 1: Initia hit by an attack exploiting a leaked GCP key; approximately $3.27 million stolen · Screenshot of source page
Image source: https://www.panewslab.com/zh/articles/01a1c708-dbb5-7433-acd3-32a44f3b899a
