Initia discloses attack path, approximately $3.27 million in assets transferred to attacker's address

Initia disclosed that an attacker exploited a leaked GCP key on Nov. 9 via command injection to access its infrastructure, then obtained GitHub, GCP and other credentials and gained access to its Rollup hosting platform Anvil, validating forged IBC withdrawals from five Rollups. Roughly $3.27 million in assets was transferred to the attacker's Initia L1 address, of which about $2.16 million remains on the paused network. After selling the stolen assets, the attacker withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC, but no INIT was taken from Initia. Initia plans to fully restore backing for affected assets and rebuild the compromised infrastructure in an isolated environment, which is expected to take longer than a standard network restart.