Second Hack of Initia in Three Weeks: Attacker Moved $3.27 Million

The first-level blockchain Initia has suffered a second hack in less than three weeks. As a result of the attack, the perpetrator transferred crypto assets worth approximately $3.27 million to their own address. The project team suspended the main network on November 10, 2026, at 06:18 UTC, after which about $2.16 million of the stolen funds remained locked in the halted blockchain.

According to the preliminary results of Initia's investigation, the attack began on November 9 with unauthorized access to the project's cloud infrastructure. The perpetrator used a compromised Google Cloud Platform (GCP) key, which was used to configure the network's private nodes.

How the perpetrator gained access to the crypto assets

The command injection attack allowed access to environment variables containing service data and access parameters. The perpetrator then infiltrated Initia's accounts on the GitHub development platform and in the GCP cloud infrastructure, obtaining additional credentials.

Using these, the attacker gained access to Anvil, a rollup hosting service, and additional networks connected to the main Initia blockchain. This allowed them to confirm fake withdrawal operations through the IBC interchain protocol and unlock assets held in the collateral accounts of five rollups.

The perpetrator sold part of the obtained funds on the decentralized Initia exchange. They then withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC beyond the network, reaching the established IBC outgoing transfer limits. The native INIT token was not withdrawn from the network during the attack.

Initia prepares to restore the network and asset collateral

The developers announced their intention to fully restore the collateral of the affected assets. A specific plan is still being agreed upon, and the recovery timeline has not been announced.

Simultaneously, the team is recreating the affected infrastructure in an isolated environment, restricting access rights to systems, and strengthening the protection of cloud services and interchain operation verification mechanisms. According to the developers, these efforts will take longer than a standard blockchain restart.

This is the second security incident for Initia in the past three weeks. On October 23, a perpetrator exploited a bug in the MoveVM virtual machine script caching mechanism, allowing them to bypass security checks and create unsecured token balances.

As a result of the first attack, assets worth approximately $2.7 million were withdrawn from the network. Unlike the October incident, the new hack, according to the team's preliminary findings, is related to the compromise of cloud credentials and interchain operation infrastructure.

At the time of publication, the exact date for the resumption of Initia's operations and the final parameters for asset collateral recovery remain unknown.