Initia confirms second exploit in 3 weeks, $3.27M stolen in latest attack

Layer-1 blockchain network Initia confirmed Wednesday that it has suffered its second security exploit in less than three weeks, with an attacker stealing about $3.27 million in crypto assets after compromising the platform’s cloud infrastructure. 

According to Initia, the attacker accessed Anvil, a platform hosting rollups, and validated fraudulent Inter-Blockchain Communication (IBC) withdrawals from five rollups, releasing assets held in the network’s escrow accounts. 

Initia said about $2.16 million of the stolen assets remain frozen on its halted network. The attacker sold assets on Initia’s decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens were withdrawn.

The incident follows an Oct. 23 exploit that saw an attacker drain about $2.7 million after exploiting a vulnerability in Initia’s MoveVM script cache. This allowed malicious code to bypass security checks and create unbacked token balances that were subsequently bridged out of the network.