Forged IBC Withdrawals Take $3.27M From Initia's Five Rollups

Initia confirmed on Wednesday that an attacker forged cross-chain withdrawals from five of its rollups and moved $3.27 million out. The project halted its layer 1 on Tuesday afternoon, and about $2.16 million of what was taken sits on the paused chain. The attacker sold the assets on Initia's own exchange, then withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT left the network. Three of the four accounts this desk read trace the entry point to a leaked cloud key, and the fourth does not mention one.

How the attacker got in

The route started outside the chain. ChainCatcher, PANews and Cointelegraph all describe a command injection attack using a leaked Google Cloud Platform key that had been used to configure private nodes. Cointelegraph adds that the breach exposed environment variables, which handed over Initia's GitHub and cloud accounts along with further credentials. From there the attacker reached Anvil, the platform that hosts Initia's rollups, and forged withdrawals over IBC, the messaging standard Cosmos chains use to move assets between one another. Those forged messages prised loose assets the layer 1 was holding on the rollups' behalf.

ChainThink tells it differently. Its account says only that the platform was compromised through cloud access credentials, and it names neither a key nor an injection. The two framings do not reconcile. All four accounts put the access on 9 November, a Monday, and all four have the money moving before the chain was stopped.

What moved and what is stuck

The totals are the one thing nobody disputes. Every account gives $3.27 million transferred to the attacker and about $2.16 million left behind on the halted layer 1. What that leftover is called varies. ChainCatcher and PANews say it cannot be moved, while ChainThink calls it currently unrecoverable, which is a stronger claim than either of the others makes. ChainThink alone reports that the attacker hit Initia's outbound IBC limit, a cap on what can leave the chain in a given period, and no second account this desk read mentions a limit at all. The account the funds came out of is a custody account in one telling and escrow accounts in another.

Three promises, three wordings

Initia says it will make holders whole, and the three versions of that promise are not identical. ChainCatcher reports a plan to fully reimburse affected assets. PANews reports a plan to fully restore them. ChainThink says the project will cover the reserves corresponding to the affected assets with the specific plan still being finalized, and it is the only account that says anything is unfinished. None of them gives the size of that reserve, a per-holder figure or a date. Recovery work is under way with help from law enforcement and security partners, according to two of the four.

A second stop in three weeks

This is not the chain's first outage of the autumn. Cointelegraph places an earlier exploit on 23 October that drained about $2.7 million through a vulnerability in Initia's MoveVM script cache, and that figure appears in one account among those read here, so it is carried with that caveat. The shape of the attack is one the year has produced repeatedly: credentials taken somewhere off-chain, then used against the chain. An internal breach at NEAR AI surfaced a day before this one, and a forged batch root drained zkLink Nova's Ethereum bridge in an earlier case.

Initia says it will rebuild the affected infrastructure in an isolated environment, and that the restart will take longer than an ordinary one. ChainThink adds tighter access controls and stronger on-chain IBC validation to that list, which no other account mentions. No restart date has been published. Until the chain comes back the $2.16 million sitting on it is a number rather than an asset, and the reimbursement promised three different ways still has no plan attached.

Read also: Initia Halts Its Layer 1 and Rollups After an Unauthorized Mint