Initia lost about $3.27 million. Was the problem with the contracts? According to the official postmortem, no—it was a leaked cloud service key.
Early this morning, Initia announced on X that on November 9, an attacker used command injection and a leaked GCP key to gain access to its infrastructure. From there, they obtained GitHub and GCP accounts and more credentials, then accessed Anvil, its rollup hosting platform, and forged IBC withdrawals for five rollups, unlocking assets in L1 escrow accounts.
About $3.27 million in assets was transferred to the attacker’s address. Around $2.16 million remains on the paused L1 and cannot be moved. The team says the attacker did not withdraw any INIT and intends to fully restore the backing of affected assets. It will announce the plan once it is finalized. The L1 was paused on November 10 at 14:18 Beijing time and is being rebuilt from scratch in an isolated environment, so recovery will take longer than a routine restart.
To be precise: even the most secure code is useless if the keys are kept in the wrong place. What ordinary users can do: rely only on announcements from Initia’s official channels, and never click links claiming to offer “compensation,” or anything similar.
#安全 #跨链 #Initia #IBC
$INIT
Early this morning, Initia announced on X that on November 9, an attacker used command injection and a leaked GCP key to gain access to its infrastructure. From there, they obtained GitHub and GCP accounts and more credentials, then accessed Anvil, its rollup hosting platform, and forged IBC withdrawals for five rollups, unlocking assets in L1 escrow accounts.
About $3.27 million in assets was transferred to the attacker’s address. Around $2.16 million remains on the paused L1 and cannot be moved. The team says the attacker did not withdraw any INIT and intends to fully restore the backing of affected assets. It will announce the plan once it is finalized. The L1 was paused on November 10 at 14:18 Beijing time and is being rebuilt from scratch in an isolated environment, so recovery will take longer than a routine restart.
To be precise: even the most secure code is useless if the keys are kept in the wrong place. What ordinary users can do: rely only on announcements from Initia’s official channels, and never click links claiming to offer “compensation,” or anything similar.
#安全 #跨链 #Initia #IBC
$INIT
