Initia: The attack originated from a GCP key leak, approximately 3.27 million dollars' worth of assets were transferred out

Initia posted on platform X to disclose the progress of the security incident investigation, stating that on November 9, attackers exploited leaked GCP keys (used to configure private nodes) to illegally access Initia's infrastructure through a command injection attack, thereby obtaining its GitHub, GCP accounts, and more credentials, and gaining access to the Rollup hosting platform Anvil, which was used to forge 5 IBC withdrawals for Rollup validation, unlocking assets in Initia's L1 IBC hosting account.

Approximately $3.27 million in assets was transferred to the attackers' address, while another $2.16 million in stolen funds remains on the suspended L1 and cannot be transferred. After selling the stolen assets on Initia DEX, the attackers withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC, without transferring any INIT. Initia stated that it plans to fully restore the affected assets and will rebuild the infrastructure in an isolated environment, with the expected restart time being longer than a regular network restart; asset recovery efforts are still ongoing with the assistance of law enforcement and security partners. Previously, it was reported that Initia L1 had suspended operations on November 10 at 14:18.