TLDR
- Initia confirmed a second exploit in under three weeks, with about $3.27 million stolen.
- The attacker used a compromised Google Cloud Platform key to reach Initia’s GitHub and cloud accounts.
- About $2.16 million of the stolen assets remain frozen on the halted network.
- An October 23 exploit drained about $2.7 million through a MoveVM flaw.
- INIT rose more than 61% in 24 hours while the network was halted.
Initia, a layer-1 blockchain network, confirmed on Wednesday that an attacker took about $3.27 million in crypto assets. It is the second security exploit the network has reported in less than three weeks. The team said the attacker got in through its cloud systems.
Based on our investigation so far, on November 9th an attacker gained unauthorized access to Initia’s infrastructure through a command injection attack with a compromised GCP key used for provisioning private nodes. This exposed environment variables, which allowed the attacker…
— Initia 🪢 (@initia) November 10, 2026
Initia said the attacker first gained access on Monday. The method was a command injection attack that used a compromised Google Cloud Platform key.
How the Attacker Got In
The breach exposed environment variables, which are settings stored in a system. Initia said this let the attacker reach its GitHub and cloud accounts. The attacker then obtained more credentials.
With that access, the attacker entered Anvil, a platform that hosts rollups. Rollups are chains that connect to the main network. The attacker validated fake Inter-Blockchain Communication (IBC) withdrawals from five rollups.
IBC lets connected blockchains pass messages and move assets. The fake withdrawals released assets held in the network’s escrow accounts. Escrow accounts hold assets that are bridged between the main chain and its rollups.
Initia said the attacker sold assets on its decentralized exchange. The attacker withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens were withdrawn.
About $2.16 million of the stolen assets remain frozen on the halted network. Initia said it plans to restore the backing of the affected assets. It said recovery work is ongoing with law enforcement and security partners.
A Timeline of the Past Three Weeks
The first exploit took place on October 23. An attacker used a flaw in Initia’s MoveVM script cache. The flaw let malicious code bypass security checks and create token balances with no backing.
Those balances were then bridged out of the network. Initia said about $2.7 million left before validators halted the chain. The assets included 105 WETH, about 1.4 million AUSD0 and about 1.08 million USDC.
The attacker later swapped the assets for 1,135.52 ETH on Ethereum. Initia said no INIT tokens were minted in that attack. The total supply of the token did not change.
The network resumed operations on November 2 after a MoveVM patch. On November 9, the team disclosed a separate issue with rollup infrastructure. It paused some rollups and said it had found no impact to user funds at that point.
Initia then found unauthorized escrow transfers. It halted its layer-1 blockchain at 06:18 UTC on November 10. Early reports put the losses much lower than the final figure.
Initia first estimated about $615,000 in unauthorized transfers. The security firm CertiK counted about $636,000 across 16 IBC transfers to the Noble blockchain. The $3.27 million figure came in Wednesday’s update.
Before the halt, about $605,000 in USDC and $10,000 in other tokens had left through Noble. Initia said it was working with validators, security specialists and exchanges on the full scope.
The team has not said when block production will resume. It has also not said whether affected users will be reimbursed. Initia warned users to avoid unofficial links, messages and recovery claims.
INSIGHT: $INIT is up 61.5% in 24 hours despite Initia pausing its Layer 1 after compromised rollup infrastructure keys were used to move about $605K in USDC out of the network. pic.twitter.com/ft7AgkM7Oz
— CoinGecko (@coingecko) November 10, 2026
INIT was trading near $0.2057 on November 10, according to CoinGecko. That was a gain of 61.31% in 24 hours, with trading volume near $84.81 million. On Wednesday, Initia said recovery efforts with law enforcement and security partners were still ongoing.
