Key facts
- Initia said the attacker reached its GitHub and cloud accounts through environment variables exposed by the compromised key.
- Initia said the attacker accessed Anvil, a rollup-hosting platform, and validated fraudulent IBC withdrawals from five rollups.
- Initia said the attacker sold assets on its decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC.
- Initia said no INIT tokens were withdrawn and that it intends to restore the backing of affected assets.
- Initia said recovery efforts are continuing with its law enforcement and security partners.
Initia said on November 11, 2026 that an attacker moved about $3.27 million in crypto assets after compromising the layer-1 blockchain's cloud infrastructure, its second security exploit in less than three weeks.
The company said the attacker gained unauthorized access on Monday, November 9 through a command injection attack involving a compromised Google Cloud Platform key. Initia said the breach exposed environment variables, letting the attacker reach its GitHub and cloud accounts and obtain further credentials.
According to Initia, the attacker accessed Anvil, a platform hosting rollups, and validated fraudulent Inter-Blockchain Communication withdrawals from five rollups, releasing assets held in the network's escrow accounts. Initia said the attacker sold assets on its decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens were withdrawn.
Initia halted its layer-1 on Tuesday and said about $2.16 million of the stolen assets remain frozen on the halted network. The blockchain said it intends to restore the backing of affected assets and that recovery efforts are continuing with its law enforcement and security partners.
The incident follows an October 23 exploit in which an attacker drained about $2.7 million after exploiting a vulnerability in Initia's MoveVM script cache, the blockchain said. That flaw allowed malicious code to bypass security checks and create unbacked token balances that were then bridged out of the network.