Cryptoproject Initia hacked again: millions of dollars looted

Blockchain network Initia (INIT) has been hit by a major cyber attack for the second time in less than three weeks. Hackers gained access to about $3.27 million worth of crypto coins by breaking into the project's technical systems. Initia has shut down its network to prevent the attackers from diverting even more funds.

Initia confirmed Wednesday 11 November that attackers had gained access to the project's infrastructure on Monday. They used a stolen access key for Google Cloud Platform, a cloud service on which some of the systems run.

That key allowed the hackers to exploit a security issue and extract sensitive data from internal systems. They then gained access to GitHub, where developers manage software, and various Initia cloud accounts.

For example, the attackers eventually reached Anvil, a platform that runs additional Initia blockchain networks.

Through this platform, the hackers were able to approve fraudulent withdrawals from five affiliated networks. As a result, crypto coins were released that were kept as collateral.

In total, the attackers gained access to about $3.27 million in crypto coins. However, a large part of it could not yet be channelled away.

Initia decided on Tuesday to temporarily shut down its main blockchain to prevent further damage.

As a result, approximately 2.16 million dollars of the affected assets are still fixed on the network. This amount cannot be moved any further for the time being.

The attacker did manage to transfer some of the loot to other networks. It concerns 13,400 Celestia (TIA), 8,000 USDC on the Injective network and 597,000 USDC on the Noble network. According to Initia, no init tokens have been included.

The project has promised to fully replenish the reserves behind the affected assets. Exactly how this will happen is still being worked out.

Meanwhile, Initia is working with security experts and law enforcement to investigate the attack. The affected infrastructure will be rebuilt and access rights tightened.

When the network will be fully operational again remains unclear for the time being.

The new cyber attack follows an earlier security incident on October 23. At that time, hackers managed to steal about 2.7 million dollars worth of crypto coins.

In that attack, they used a vulnerability in Initia's software. This allowed them to create crypto coins without sufficient underlying assets. Subsequently, those coins were transferred to other networks.

The two attacks are therefore clearly different from each other. Where hackers exploited a flaw in the blockchain software in October, this time they gained access via a stolen cloud key and the project's internal systems.

In both cases, the attackers eventually managed to bypass the security used to manage crypto coins on the network.