Initia exploit drains $3.27M as LNbits patches and Across reclaims hijacked domain

Initia traced the November 9 break-in to a command injection attack riding on a compromised Google Cloud Platform key used for private node provisioning. That spilled environment variables, which in turn handed the attacker access to the project's GitHub and cloud accounts plus more credentials. From there they reached Anvil, the hosting platform for rollups on the network, and validated forged Inter-Blockchain Communication withdrawals from five rollups — unlocking assets parked in the layer-1's IBC escrow accounts.

Roughly $3.27 million in assets landed at an attacker-controlled address on Initia, while about $2.16 million stayed stranded on the paused chain. The attacker sold assets on Initia's decentralized exchange and pulled out 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC before slamming into outbound rate limits. No INIT tokens left the network. Validators halted the layer-1 on November 10, and the team says it will restore backing for affected assets in full once a recovery plan is locked in, rebuilding the hit infrastructure from scratch in an isolated environment with tighter access controls and stronger validation.

It's the second blow in under three weeks. In late October, a MoveVM script-caching flaw let an attacker mint unbacked bridged token balances and exit with roughly $2.7 million before the network was paused.

LNbits, the open-source Bitcoin Lightning wallet and accounts platform, shipped version 1.7.0 as an urgent security update after a wave of attacks on self-hosted instances. The project had already told every operator to shut servers down immediately while patches were built, citing active exploitation that put funds at risk. The release hardens authentication, extension management and payment handling, and every version before 1.7.0 is affected. Updating alone may not be enough if credentials leaked — operators are told to reset wallet keys, swap out funding source credentials, treat stored secrets as compromised and spin up a fresh server if they suspect a breach. Creator Ben Arc called it a tough stretch with losses for both users and the project while the team raced to ship. One reported case saw about 2.3 million satoshis withdrawn through newly created accounts before the server could be stopped, and hosted services were taken offline during the response.

Across Protocol spent a tense day fighting for its domain. The cross-chain bridge first warned users off its app — no wallet connections, no transactions, no approvals — while it investigated, as reports of drained wallets and stablecoin losses piled up. It later pinned the damage on a social engineering attack against registrar Namecheap around 18:45 UTC on November 10 that handed an attacker control of across.to and pointed it at a phishing page. The team caught on within about 15 minutes and got backup from SEAL911, which flagged the domain as phishing with major wallets, and Cloudflare, which marked it at risk and pulled DNS records. Third-party integrations and API users were untouched. The domain was back under team control on November 11 with help from Namecheap founder Richard Kirkendall, and all systems returned to normal. Across pledged to make every affected user whole and to publish a full post-mortem; anyone who granted approvals on the fake site was told to revoke them.