Initia, a Binance Labs-backed blockchain for rollups, halted its network for the second time in three weeks after a hack. Validators stopped processing transactions at 06:18 UTC on November 10, after which the project disclosed the breach on X.
The attack happened on November 9: the intruder gained access to Initia's infrastructure through a stolen Google Cloud credential combined with a command-injection flaw, then reached the project's code repository and cloud accounts, Initia said.
The breach hit the Anvil rollup platform, five rollups and the IBC withdrawal validation system: withdrawals included 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC, worth about $3.27 million, with $2.16 million still frozen on the halted network.
Initia said the incident involved unauthorized transfers from L1 escrow accounts that back assets on connected rollups. The chain was halted, and the project is working with investigators and outside security specialists.
Protos put the loss from this attack alone at $615,000, and said combined losses from this hack and an earlier one in October reached $3.3 million over three weeks. It remains unclear who was behind the attack, and whether most of the stolen funds will be returned to users.
Initia's first hack hit on October 23, when an attacker drained $2.7 million by exploiting a script-caching bug in MoveVM, halting the network that time as well.
