Overview
- Initia stopped block production at 06:18 UTC on Tuesday after operators found unauthorized transfers out of escrow accounts that hold assets bridged between the L1 and its rollups.
- Investigators say an attacker used a compromised Google Cloud Platform provisioning key in a command‑injection attack that exposed environment variables and let the attacker reach GitHub and other cloud accounts.
- With those credentials the attacker accessed rollup hosting (Anvil) and validated forged Inter‑Blockchain Communication messages to release escrowed assets, a mechanism that normally moves tokens between chains.
- Initia updated losses to about $3.27 million total, with roughly $2.16 million of the stolen funds remaining frozen on the halted L1 while recovery work with law enforcement and security partners continues.
- This is Initia's second breach in under three weeks after an October 23 MoveVM script‑cache flaw that allowed about $2.7 million to be bridged out, and the project has not given a restart date or a final reimbursement decision while markets react to the outage.