Initia Suffers Second Crypto Exploit in Three Weeks, $3.27 Million Stolen
Layer-1 blockchain Initia has confirmed its second security breach in less than three weeks, with attackers gaining control of approximately $3.27 million in cryptocurrency assets. The latest exploit involved compromised cloud credentials that allowed unauthorized withdrawals from accounts holding assets bridged across the network.
Initia halted its blockchain on November 10, 2026, to prevent further losses. The company confirmed that approximately $2.16 million of the compromised assets remains frozen on the suspended network, limiting the attacker’s ability to transfer additional funds.
Compromised Cloud Credentials Trigger Security Breach
According to Initia’s investigation, the attacker gained unauthorized infrastructure access on November 9 through a compromised Google Cloud Platform (GCP) key. The attacker used a command injection vulnerability to expose sensitive environment variables and obtain additional credentials.
These credentials provided access to Initia’s GitHub and cloud accounts before the attacker reached Anvil, the platform hosting Initia’s rollups. The attacker subsequently forged Inter-Blockchain Communication (IBC) withdrawals involving five rollups, unlocking assets held in the blockchain’s escrow accounts.
The attacker transferred approximately $3.27 million to an address on Initia’s network. However, the blockchain shutdown prevented the movement of roughly $2.16 million of those assets.
Second Attack Raises Concerns About Blockchain Security
The latest incident follows an October 23 exploit that resulted in approximately $2.7 million in cryptocurrency losses. That earlier attack exploited a vulnerability in Initia’s MoveVM implementation, allowing unauthorized token balances to be created and transferred.
Following the October incident, Initia temporarily suspended operations before restoring network activity on November 2. Just eight days later, the blockchain experienced another significant security breach.
During the latest attack, the exploiter withdrew approximately 13,400 TIA tokens, 8,000 USDC.inj and 597,000 Noble USDC. Initia confirmed that the attacker did not withdraw any native INIT tokens.
Initia Plans Asset Recovery and Infrastructure Overhaul
Initia said it intends to fully restore the reserves backing affected assets while continuing recovery efforts with security specialists and law enforcement. However, the project has not announced a specific timeline for completing the recovery process.
The development team is rebuilding compromised infrastructure within an isolated environment and strengthening access controls. It also plans to improve verification mechanisms for cross-chain transactions to reduce the risk of similar attacks.
The network’s restart will take longer than a routine recovery because of the additional security measures. Meanwhile, the repeated exploits highlight the risks associated with compromised infrastructure credentials and cross-chain asset management.
