The Initia layer-1 blockchain has suffered a second security breach in less than three weeks after an attacker exploited a compromised Google Cloud key to gain access to internal systems and authorize fraudulent withdrawals across five rollups. The incident resulted in approximately $3.27 million in stolen digital assets, raising further concerns about the network’s security infrastructure and the protection of assets bridged across its ecosystem.
The latest attack marks another significant security setback for Initia, which is now dealing with the consequences of multiple breaches within a relatively short period. The attacker reportedly obtained access to internal systems through a compromised Google Cloud credential and used that access to approve unauthorized withdrawal transactions.
Five Rollups Affected by Unauthorized Withdrawals
The security incident involved five rollups connected to the Initia ecosystem. By compromising the systems responsible for approving withdrawals, the attacker managed to authorize fraudulent transactions and move assets worth approximately $3.27 million.
The stolen funds primarily consisted of bridged digital assets, including USD Coin (USDC) and TIA. The breach did not involve the theft of INIT tokens, indicating that the attack was directed at assets transferred across the network rather than the blockchain’s native token.
The incident highlights the risks associated with administrative credentials and the infrastructure responsible for managing cross-chain asset movements. Although blockchain transactions are generally protected by cryptographic verification, weaknesses in privileged access systems can create opportunities for attackers to manipulate transaction approval processes.
The compromise of a Google Cloud key reportedly allowed the attacker to bypass normal operational safeguards and approve forged withdrawals from five rollups, resulting in losses of approximately $3.27 million.
Network Halt Freezes More Than $2 Million in Assets
Following the discovery of the breach, Initia halted its network on November 10 to prevent further unauthorized transactions. The suspension has effectively stopped on-chain activity, leaving users unable to execute transactions while the team investigates the incident and works to secure the affected infrastructure.
Approximately $2.16 million of the stolen assets remain frozen as a result of the network shutdown. The remaining funds have already been moved, although the available information does not establish whether they can be recovered.
The network suspension represents an important containment measure because it limits the possibility of additional withdrawals while developers investigate the compromised systems. However, the interruption also affects legitimate users who depend on the network for transfers and other blockchain operations.
Initia has not provided a confirmed timeline for restarting the network. The absence of a restart date suggests that the team is prioritizing security assessments and recovery measures before restoring normal operations.
Initia Promises to Restore Asset Backing
Initia has indicated that it intends to restore the backing of tokens affected by the exploit. This commitment is particularly important for holders of bridged assets, as the security breach has raised questions about the reserves supporting tokens circulating across the network.
The Initia L1 was halted at 06:18 UTC on November 10 in coordination with validators as a protective measure.
We took this step after identifying unauthorized transfers from the escrow accounts on the Initia L1 that hold assets bridged to several rollups. Our investigation so far indicates that the transfers were made using compromised rollup infrastructure keys allowing an attacker to fabricate IBC transfers.
Our preliminary review indicates that approximately $605,000 USDC left Initia through Noble along with $10k in other tokens before the network was paused. Most of the remaining assets moved out of the escrow accounts are still on the halted L1.
We are working to determine the full scope with security teams, validators, and exchanges. We will share more details as they become available. Please remain cautious of unofficial links, messages, or claims.
— Initia 🪢 (@initia) November 10, 2026
The project has pledged to restore backing for affected tokens and is coordinating with law enforcement as it investigates the breach and works toward recovering from the incident.
The restoration process will be a critical component of the recovery effort. Users will likely look for clear information about the affected assets, the recovery mechanism, and the safeguards being introduced to prevent similar incidents.
The investigation will also need to establish how the Google Cloud credential was compromised and whether additional internal systems or access permissions were exposed.
Based on our investigation so far, on November 9th an attacker gained unauthorized access to Initia’s infrastructure through a command injection attack with a compromised GCP key used for provisioning private nodes. This exposed environment variables, which allowed the attacker to access our GitHub and GCP accounts and obtain further credentials.
With these credentials the attacker gained access to Anvil, the hosting platform used by rollups on Initia. Through this the attacker was able to validate forged IBC withdrawals from five rollups, unlocking assets held by the Initia L1’s IBC escrow accounts.
Around $3.27m of assets were moved to the attacker’s Initia L1 address with $2.16m of the stolen funds remaining on the paused L1 where they cannot be moved. The attacker sold stolen assets on the Initia DEX and then withdrew 13.4k TIA, 8k USDC.inj, and 597k Noble USDC reaching Initia’s outbound IBC rate limits. No INIT was withdrawn from Initia by the attacker.
We intend to restore the backing of affected assets in full. We are finalizing the plan and will share the details once it is confirmed.
As a precaution, we are rebuilding the affected infrastructure from scratch in an isolated environment, enforcing least-privilege access controls, and hardening security at every layer of the stack from cloud infrastructure to onchain IBC validation. Given the above, we expect this process to be longer than a routine network restart. We will share timelines as they become available.
All announcements will be made through Initia’s official channels. Thank you for your patience.
— Initia 🪢 (@initia) November 10, 2026
Users Warned Against Fraudulent Refund Offers
Meanwhile, users have been advised to remain cautious about fraudulent websites and unsolicited recovery offers claiming to provide refunds for stolen assets. Security incidents often create opportunities for secondary scams, with attackers targeting affected investors through fake compensation portals and impersonation campaigns.
Investors should rely exclusively on Initia’s official communication channels for verified announcements about the investigation, asset restoration, and network restart.
The latest breach underscores the importance of securing cloud credentials, strengthening administrative access controls, and implementing additional safeguards for withdrawal approvals across interconnected blockchain networks.
Until Initia completes its investigation and confirms that the affected infrastructure is secure, users should exercise caution when interacting with the network and avoid unofficial recovery services.
