Initia second hack explained: how $3.27M was stolen

Initia has been exploited for the second time in three weeks. This time the weak point was the team's cloud infrastructure rather than the chain's code. An attacker used a leaked Google Cloud key to reach the rollup hosting platform and forge withdrawals from the main chain. According to Initia, about $3.27M in assets moved to the attacker's address, and $2.16M of that is stuck on the halted network.

What we know now

• The Initia L1 has been halted since 1:18 AM ET on Nov. 10, and no restart date has been set. The team is rebuilding the affected infrastructure from scratch and says the process will take longer than a routine restart (Initia).
• The attacker received roughly $3.27M in assets, and $2.16M of it remains on the paused L1. The difference, about $1.1M, left the chain as 13.4K TIA, 8K USDC.inj and 597K USDC via Noble. No INIT was withdrawn.
• Initia says it intends to restore the backing of affected assets in full and is finalizing the plan.
• Cointelegraph reports that recovery efforts involve law enforcement and security partners.
• We have not yet found the attacker's addresses, any freezes by Noble, Circle or exchanges, or findings from PeckShield, Cyvers or ZachXBT on this incident.

How it happened

Initia says the attack began on Nov. 9 with command injection. The attacker used a compromised Google Cloud (GCP) key that Initia used to provision private nodes. That exposed server environment variables, which led to the team's GitHub and GCP accounts and more credentials.

With those credentials the attacker got into Anvil, the platform that hosts Initia's rollups. Rollups are separate chains that settle to the L1. Tokens bridged from the L1 into a rollup sit in L1 escrow accounts, and the L1 releases them on withdrawal once the rollup confirms the transfer over IBC. With control over the infrastructure of five rollups, the attacker validated withdrawals that never happened, and the L1 handed over real assets from escrow.

The first exploit, on Oct. 23, worked differently. A MoveVM script-caching bug let an attacker mint unbacked tokens (our explainer). This time neither smart contracts nor the VM were at fault: cloud keys gave the attacker permissions the chain treated as legitimate.

Timeline

Nov. 9. The attacker breaks into Initia's infrastructure through command injection and a compromised GCP key, then reaches GitHub, GCP and Anvil (per Initia; exact time not disclosed).

Nov. 10, 1:18 AM ET. Initia halts the L1 in coordination with validators after spotting unauthorized transfers from escrow accounts that hold assets bridged to rollups.

Nov. 10, 2:07 AM ET. Initia's first statement. A preliminary review shows about $605K USDC left via Noble, plus $10K in other tokens, before the pause. Most other assets moved out of escrow are still on the halted L1. The cause given is compromised rollup infrastructure keys.

Nov. 10, 2:59 AM ET. TokenPost reports INIT up 80% in 24 hours and trading above $0.23 while the network is halted.

Nov. 10, 6:31 AM ET. crypto.news cites CertiK: about $636K left in 16 successful IBC transfers to Noble, slightly above Initia's first estimate. Citing CoinGecko, it puts INIT up 61% in 24 hours, from $0.12 to $0.23, on $84.8M in volume.

Nov. 10, 11:43 AM ET. Initia publishes details: the access chain from the GCP key to Anvil, forged IBC withdrawals from five rollups, and about $3.27M moved, with $2.16M locked on the L1. The team pledges to restore the backing of affected assets in full and rebuild infrastructure in an isolated environment with least-privilege access.

Nov. 11. Cointelegraph reports that Initia is pursuing recovery with law enforcement and security partners.

Where the money went

Everything stayed inside the Cosmos ecosystem this time, unlike October's exit to Ethereum. The attacker received the assets at an Initia L1 address and sold part of them on the Initia DEX. Over IBC they then withdrew 13.4K TIA (Celestia's token), 8K USDC.inj (USDC on Injective) and 597K USDC to Noble. Initia's outbound IBC rate limits on the L1 stopped further withdrawals (Initia). The remaining $2.16M sits at the attacker's address on the halted chain.

Where the funds went after Noble and Injective is not yet public, and the team has not disclosed the address.

What the team and exchanges did

• Initia halted the L1 with validators, is rebuilding its infrastructure from scratch and has pledged to restore the backing of affected assets in full. The plan and timeline will follow. Announcements go out only through official channels.
• CertiK counted 16 suspicious IBC transfers to Noble worth $636K (per crypto.news).
• We have not found statements from Noble, Circle, Upbit, Bithumb or Binance about freezes or INIT restrictions after the second exploit.

What it means for holders

While the L1 is halted, tokens cannot move inside Initia or leave over IBC. Holders of TIA, USDC and other assets that sat in Initia rollups will have to wait: the team has promised to restore backing but has not shared details. The attacker did not withdraw native INIT. The token rose 61% to 80% over 24 hours after the halt, depending on the source, and none of the outlets offered a reason.

This is the second incident in three weeks. After the October exploit the chain stayed offline for more than nine days, and the team now warns this restart will take longer. Scammers tend to push fake "compensation" links during pauses like this, so rely only on Initia's official channels. Live prices are in the daily brief. Our news story on the second exploit is here.

This is not investment advice.

---

This story is developing: we are following events and adding new information. Last updated Nov. 11, 2026, 1:20 AM ET.