Claiming the likes of Binance Labs, Delphi Ventures, and HackVC among its backers, Initia L1 acts as a “base layer and central liquidity hub for all Interwoven Rollups.”
On Tuesday morning, the Initia X handle announced a chain halt in response to the discovery of “unauthorized transfers from the escrow accounts on the Initia L1 that hold assets bridged to several rollups.”
The post blamed “compromised rollup infrastructure keys allowing an attacker to fabricate IBC transfers” and tallied $615,000 that made it off-chain. However, “most” of the assets removed from escrow accounts remain on Initia, indicating that they may be recoverable via validator coordination.
Second hack in three weeks
Tuesday’s hack comes less than three weeks after a script caching bug let an attacker “artificially [spoof] the MoveVM state, thereby crediting themselves with unbacked WETH, iUSD, and USDC tokens.”
That incident led to $2.7 million in losses bridged to Ethereum, and was also met with a halt of Initia chain and its rollups. They came back online on November 2 before being hacked again eight days later.
The combined losses of $3.3 million across the two incidents is greater than Initia’s remaining TVL, which is down over 90% from its peak shortly after launching in May last year.
Reactions to this most recent incident have been aggressive, with users urging the chain to shut down and accusing the team of an inside job. Strangely, Initia’s INIT token is up around 60% over the last 24 hours, leading to suspicions of a “crime pump” from frustrated users.
protos.com
