Two separate crypto security failures compounded concerns this week. Initia disclosed a cloud infrastructure breach that enabled forged IBC withdrawals from five rollups, while LNbits warned that its latest Bitcoin wallet update cannot revoke credentials that may already have been leaked.
Initia cloud breach details. On November 9, an attacker gained unauthorized access to Initia's infrastructure through a command injection attack using a compromised Google Cloud Platform key used for provisioning private nodes. The attacker accessed exposed environment variables, then used them to enter Initia's GitHub and GCP accounts. With those credentials, the attacker reached Anvil, the hosting platform for rollups on Initia, and validated fraudulent Inter-Blockchain Communication withdrawals from five rollups. About $3.27 million in assets moved to the attacker's Initia L1 address, with $2.16 million remaining on the paused Layer 1. The attacker sold stolen assets on Initia's decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC before hitting outbound IBC rate limits. No INIT was withdrawn by the attacker.
Initia said it intends to restore backing of affected assets in full and is rebuilding affected infrastructure from scratch in an isolated environment, enforcing least-privilege access controls and hardening security from cloud infrastructure to onchain IBC validation. The project expects the process to be longer than a routine network restart. This was the second major security breach in three weeks; an October 23 exploit using a MoveVM script cache vulnerability caused about $2.7 million in losses.
LNbits credential leak warning. In a separate incident, LNbits' November 10 security notice said credentials exposed before an upgrade may still give an attacker access afterward. The vulnerability was found on November 8. Operators were first told to disable the Paywall extension, then to shut servers down entirely; LNbits took its own hosted instances offline. Version 1.7.0 followed on November 10, and all earlier versions were affected. Version 1.7.1 arrived November 11 with a one-line release note: “Rotates auth keys.” That update rotates the authentication signing key and logs out session tokens, but does not reset wallet Admin and Invoice keys, funding-source credentials, or app and device connections. LNbits creator Ben Arc said both the project and its users lost money.
LNbits documentation and Start9 package notes explain that deleting an LND macaroon does not revoke a copied credential because the Lightning node validates it against a root key. Recovery requires rotating backend credentials first, resetting wallet keys, and recreating app and card connections. A hosted instance user should verify that their wallet keys were reset after the upgrade; otherwise, the wallet remains in the same exposed position as before November 10.
