Mentioned in This Article
1. Initia exploit: what happened
Layer-1 blockchain Initia confirmed on Wednesday, November 11, that an attacker moved about $3.27 million in crypto assets after breaking into its cloud infrastructure with a compromised Google Cloud Platform key. Roughly $2.16 million of that sum remains frozen on Initia's network, which has been halted since Tuesday. It is the project's second exploit in less than three weeks.
The disclosure came in a statement Initia published on X, laying out how the intrusion unfolded over three days. According to the project, the attacker first gained a foothold on Monday, November 9, escalated that access into control over key parts of the network's supporting systems, and then used those systems to release assets that were supposed to stay locked in escrow.
The episode lands at a sensitive moment for the network. Initia had only recently recovered from an October 23 exploit that drained about $2.7 million through a flaw in its virtual machine. The new incident did not rely on a bug in the chain's code at all. Instead, it came through the operational layer that surrounds the blockchain: cloud accounts, code repositories and the hosting platform used to run rollups.
2. How did the attacker get in?
The attacker got in through a leaked Google Cloud Platform key, which Initia says was used in a command injection attack. Command injection is a technique in which an intruder tricks a system into running instructions of the attacker's choosing, typically by smuggling commands into input that the system trusts. Paired with a valid cloud key, it can give an outsider the same reach as a legitimate operator.
From that starting point, the attacker worked outward. Initia said the intruder was able to reach the project's GitHub and cloud accounts and collect additional credentials along the way. Each new set of keys widened the attacker's access, a pattern security teams describe as lateral movement: rather than breaking down one heavily guarded door, the intruder walks from room to room using keys found inside the building.
That chain of access eventually led to Anvil, which Initia describes as a platform that hosts rollups connected to its network. Control over that hosting layer proved to be the decisive step, because it put the attacker in a position to act on behalf of rollups that the main chain treats as trusted counterparties.
3. Forged withdrawals from five rollups
Once inside Anvil, the attacker validated fraudulent Inter-Blockchain Communication (IBC) withdrawals from five separate rollups, Initia said. Those forged messages caused the layer-1 to release assets held in its IBC escrow accounts, the reserves that back tokens moved between Initia and the chains built on top of it.
IBC is the messaging standard that lets independent blockchains pass tokens and data to one another. When a token leaves one chain for another, the original is typically locked in an escrow account on the sending chain while a representation is created on the receiving chain. Moving it back reverses the process: the receiving chain sends a withdrawal message, and the original chain unlocks the escrowed asset. The system depends on the receiving chain's messages being genuine.
That dependence is what the attacker exploited. With control over infrastructure that could sign off on rollup activity, the intruder was able to produce withdrawal messages that looked legitimate to the layer-1. The main chain did what it was designed to do and released the funds. No user wallets had to be compromised, and no smart contract had to be broken, for the escrow to be emptied.
Rollups are secondary networks that process transactions separately and rely on a base layer for settlement and security. Initia's design places its layer-1 at the center of a group of such rollups, which makes the escrow accounts on the main chain a natural concentration point for value, and therefore a natural target.
4. What was taken, and what is still frozen
In total, about $3.27 million in assets was transferred to the attacker, according to Initia. Most of it never left the network. Around $2.16 million is still sitting on the halted layer-1, where it cannot be moved while block production is stopped.
Before the halt, the attacker sold some of the assets on Initia's decentralized exchange and withdrew the proceeds off the network. Initia listed the outflows as 13,400 Celestia (TIA) tokens, 8,000 USDC.inj and 597,000 Noble USDC. USDC.inj and Noble USDC are versions of Circle's dollar stablecoin USD Coin (USDC) that circulate across chains in the Cosmos ecosystem, with Noble serving as the chain that issues native USDC for IBC-connected networks.
Initia stressed that no INIT, the network's native token, was withdrawn. That detail matters for holders of the token, because it means the attacker did not walk away with a position in the chain's own asset that could later be dumped on the open market.
The split between frozen and withdrawn funds also shapes what recovery might look like. Assets still on a halted chain are, in practical terms, under the control of the network's operators and validators once it restarts. Assets already bridged away, especially stablecoins, depend on the cooperation of issuers, exchanges and investigators to be traced and potentially blocked.
5. Network halt and Initia's recovery plan
Initia stopped its layer-1 on Tuesday, November 10, the day after the initial intrusion. Halting a chain freezes the ledger in place, preventing further transfers, trades or withdrawals, and it is the step that kept the bulk of the stolen funds from leaving.
In a follow-up post, Initia said it intends to restore backing for the affected assets, meaning the escrow accounts that were emptied would be made whole so that the tokens circulating on its rollups remain fully supported. Recovery efforts are ongoing in cooperation with law enforcement and security partners, the project said.
Initia has not said when the network will resume operations. Because this breach ran through cloud and code-hosting accounts rather than a single faulty function, any restart is likely to require more than a software patch. Credentials have to be rotated, access to every affected system reviewed, and the hosting environment for rollups secured before validators can safely produce blocks again.
6. The October 23 MoveVM exploit
The latest incident follows an October 23 attack in which about $2.7 million was drained from Initia. In that case, the attacker abused a vulnerability in the script cache of MoveVM, the virtual machine that executes programs written in the Move language on Initia.
The flaw allowed malicious code to slip past security checks and create token balances that had no real backing. The attacker then bridged those unbacked balances out of the network, converting fictitious tokens into real assets on other chains.
The two exploits are very different in nature. October's was a software defect inside the chain's execution environment, the kind of bug that audits and formal reviews are meant to catch. November's was an operational security failure: a leaked key that opened a path into the cloud, code and hosting accounts that keep the network running. Taken together, they show attackers probing Initia from two directions within the span of a few weeks.
7. Why infrastructure keys have become a target in crypto hacks
Crypto hacks are often imagined as clever attacks on smart contract logic, but many of the most damaging incidents in the industry begin with stolen credentials. Private keys for signing transactions, API keys for cloud providers and access tokens for code repositories can all give an attacker the ability to act as the project itself.
The Initia breach illustrates why. Blockchains that connect to rollups or other chains have to trust certain messages from their partners. When the infrastructure that produces those messages lives in conventional cloud accounts, the security of the entire bridge can come down to how carefully those accounts are guarded. A single exposed key, as in this case, can become the first link in a chain that ends with an escrow account being emptied.
For projects building multi-chain systems, the incident underlines a familiar lesson: the boundary of a blockchain's security extends well beyond its consensus rules. Cloud permissions, secrets management, repository access and the separation of duties between systems all form part of the attack surface, and each needs the same scrutiny given to on-chain code.
Common defenses against this kind of intrusion are well established in conventional software security: granting each key only the narrow permissions it needs, storing secrets in dedicated vaults rather than in places where a compromised process can read them, requiring multiple approvals for sensitive actions, and monitoring for unusual activity in cloud and repository accounts. The difficulty for crypto projects is that a lapse in any one of these layers can translate directly into lost funds.
8. What happens next for Initia
The immediate questions for Initia users are when the layer-1 will restart and how the project will restore backing for the drained escrow accounts. Initia has committed to the latter but has not provided a timeline or a detailed mechanism.
The frozen $2.16 million gives the project a meaningful head start on recovery, since those funds have not left the network. The fate of the withdrawn TIA and USDC will depend on the investigation now underway with law enforcement and security partners.
Beyond the immediate cleanup, Initia faces a harder task in rebuilding confidence. Two exploits in under three weeks, one through code and one through infrastructure, will put pressure on the team to show that both its software and its operational practices have been overhauled before users return funds to the network.