Initia confirms second exploit in three weeks, $3.27m stolen
A compromised Google Cloud key allowed the attacker to forge withdrawals from five rollups, leaving $2.16m frozen on the halted network.
Key takeaways
- 1Initia suffered its second exploit in under three weeks.
- 2The attacker stole approximately $3.27 million in crypto assets.
- 3About $2.16 million of the stolen assets remain frozen on the halted network.
- 4The breach involved a compromised Google Cloud Platform key.
- 5No INIT tokens were withdrawn during the attack.
Initia said on Wednesday it has suffered its second security exploit in less than three weeks, with an attacker stealing about $3.27 million in crypto assets. The company confirmed the breach on 11 November 2026.
The attacker gained access on Monday through a command injection attack using a compromised Google Cloud Platform key. This exposed environment variables, giving the intruder access to Initia’s GitHub and cloud accounts to obtain further credentials.
With these new credentials, the attacker accessed Anvil, a platform hosting rollups, and validated fraudulent Inter-Blockchain Communication withdrawals from five rollups. This released assets held in the network’s escrow accounts.
The attacker sold assets on Initia’s decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens were withdrawn during the incident.
Initia halted its layer-1 network on Tuesday and said it will restore the backing of affected assets. Recovery efforts are ongoing with law enforcement and security partners.
The incident follows an exploit on 23 October that saw an attacker drain about $2.7 million by exploiting a vulnerability in Initia’s MoveVM script cache. That attack allowed malicious code to bypass security checks and create unbacked token balances.
Traders will watch how quickly Initia can restore network stability and recover the remaining frozen funds. The repeated security incidents may affect institutional confidence in the platform.
Security experts note that cloud credential management remains a critical failure point for blockchain infrastructure. Companies are advised to audit their cloud access controls regularly.
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.