The attack started with a command injection using a compromised Google Cloud key that Initia used to provision private nodes. The exposed environment variables gave the attacker access to the team's GitHub and GCP accounts, as laid out in Initia's incident update.

With those credentials the attacker reached Anvil, the hosting platform for Initia rollups, and validated forged IBC withdrawals from five rollups. That unlocked assets held in the Initia L1 IBC escrow accounts.

About $3.27M moved to the attacker's address, and $2.16M of it remains frozen on the paused L1.

Before hitting outbound IBC rate limits, the attacker withdrew 13.4K TIA, 8K USDC.inj and 597K Noble USDC. No INIT left the chain. Initia plans to restore the backing of affected assets in full and is rebuilding its infrastructure from scratch, so the restart will take longer than usual.