The Initia layer-1 blockchain has suffered its second security breach in less than three weeks, after an attacker exploited a compromised Google Cloud key to gain access to internal systems and authorize fraudulent withdrawals across five rollups. Approximately $3.27 million in digital assets was stolen, intensifying concerns about the network's security infrastructure and the protection of assets bridged across its ecosystem.

Attack Chain: From a Compromised GCP Key to Forged Withdrawals

According to Initia's account of the incident, the intrusion began on November 9, when the attacker gained unauthorized access to the project's infrastructure through a command injection attack using a compromised Google Cloud Platform (GCP) key employed for provisioning private nodes. The breach exposed environment variables, which in turn gave the attacker access to Initia's GitHub and GCP accounts and to further credentials stored within them.

With those credentials, the attacker reached Anvil, the hosting platform used by rollups deployed on Initia. From there, the attacker was able to validate forged Inter-Blockchain Communication (IBC) withdrawals from five rollups, unlocking assets held in the Initia L1's IBC escrow accounts. IBC is the interoperability protocol that moves tokens between Initia's rollups, its L1, and external networks such as Noble, which made the L1's escrow accounts the shared chokepoint for assets bridged from all five rollups.

Around $3.27 million of assets were moved to an attacker-controlled address on the Initia L1, of which roughly $2.16 million remains on the paused chain, where it cannot be moved. The attacker sold stolen assets on the Initia decentralized exchange and then withdrew 13.4k TIA — the native token of the Celestia data availability network — 8k USDC.inj, and 597k Noble USDC, the USD Coin issued on the Noble chain. Those outflows reached Initia's outbound IBC rate limits, controls designed to cap how much value can exit the chain through IBC within a given period. No INIT, the network's native token, was withdrawn by the attacker.

The stolen funds primarily consisted of bridged digital assets, including USD Coin (USDC) and TIA, indicating the attack targeted assets transferred across the network rather than the native token itself. The incident underscores the risks tied to privileged credentials and the infrastructure managing cross-chain asset movements: while blockchain transactions are generally protected by cryptographic verification, weaknesses in administrative access systems can create opportunities for attackers to manipulate transaction approval processes.

Initia detailed its findings in a statement posted on X:

"Based on our investigation so far, on November 9th an attacker gained unauthorized access to Initia's infrastructure through a command injection attack with a compromised GCP key used for provisioning private nodes. This exposed environment variables, which allowed the attacker to access our GitHub and GCP accounts and obtain further credentials. With these credentials the attacker gained access to Anvil, the hosting platform used by rollups on Initia. Through this the attacker was able to validate forged IBC withdrawals from five rollups, unlocking assets held by the Initia L1's IBC escrow accounts. Around $3.27m of assets were moved to the attacker's Initia L1 address with $2.16m of the stolen funds remaining on the paused L1 where they cannot be moved. The attacker sold stolen assets on the Initia DEX and then withdrew 13.4k TIA, 8k USDC.inj, and 597k Noble USDC reaching Initia's outbound IBC rate limits. No INIT was withdrawn from Initia by the attacker. We intend to restore the backing of affected assets in full. We are finalizing the plan and will share the details once it is confirmed. As a precaution, we are rebuilding the affected infrastructure from scratch in an isolated environment, enforcing least-privilege access controls, and hardening security at every layer of the stack from cloud infrastructure to onchain IBC validation. Given the above, we expect this process to be longer than a routine network restart. We will share timelines as they become available. All announcements will be made through Initia's official channels. Thank you for your patience."

— Initia (@initia) November 10, 2026 (X post)

Network Halted at 06:18 UTC, Freezing $2.16 Million

Initia halted the Initia L1 at 06:18 UTC on November 10, in coordination with validators, as a protective measure after identifying unauthorized transfers from the escrow accounts holding assets bridged to several rollups. The suspension has stopped on-chain activity, leaving users unable to execute transactions while the team investigates the incident and works to secure the affected infrastructure.

According to the company's preliminary review, approximately $605,000 USDC left Initia through Noble, along with $10k in other tokens, before the network was paused. Most of the remaining assets moved out of the escrow accounts are still on the halted chain.

The halt serves as an important containment measure, limiting the possibility of additional withdrawals while developers examine the compromised systems. However, the interruption also affects legitimate users who depend on the network for transfers and other blockchain operations. Initia has not provided a confirmed timeline for restarting the network, suggesting the team is prioritizing security assessments and recovery measures before restoring normal operations.

In its first public statement, Initia said:

"The Initia L1 was halted at 06:18 UTC on November 10 in coordination with validators as a protective measure. We took this step after identifying unauthorized transfers from the escrow accounts on the Initia L1 that hold assets bridged to several rollups. Our investigation so far indicates that the transfers were made using compromised rollup infrastructure keys allowing an attacker to fabricate IBC transfers. Our preliminary review indicates that approximately $605,000 USDC left Initia through Noble along with $10k in other tokens before the network was paused. Most of the remaining assets moved out of the escrow accounts are still on the halted L1. We are working to determine the full scope with security teams, validators, and exchanges. We will share more details as they become available. Please remain cautious of unofficial links, messages, or claims."

— Initia (@initia) November 10, 2026 (X post)

Initia Pledges to Restore Asset Backing in Full

The project has pledged to restore the backing of affected tokens in full, a commitment that carries particular weight for holders of bridged assets, as the breach has raised questions about the reserves supporting tokens circulating across the network. Initia said it is finalizing the restoration plan and will share details once confirmed, and it is coordinating with law enforcement as it investigates the breach and works toward recovering from the incident.

As a precaution, the team is rebuilding the affected infrastructure from scratch in an isolated environment, enforcing least-privilege access controls, and hardening security at every layer of the stack, from cloud infrastructure to on-chain IBC validation. Given that work, Initia expects the recovery process to take longer than a routine network restart and has committed to publishing timelines as they become available.

The ongoing investigation will also need to establish precisely how the Google Cloud credential was compromised and whether additional internal systems or access permissions were exposed. For users and holders, the concrete milestones to watch are the finalized restoration plan and a confirmed timeline for bringing the network back online, with all announcements routed through Initia's official channels.

Users Warned Against Fraudulent Refund Offers

Alongside the breach response, users have been advised to remain cautious about fraudulent websites and unsolicited recovery offers claiming to provide refunds for stolen assets. Security incidents often create opportunities for secondary scams, with attackers targeting affected investors through fake compensation portals and impersonation campaigns.

Investors should rely exclusively on Initia's official website and verified communication channels for announcements about the investigation, asset restoration, and network restart.

The incident highlights the importance of securing cloud credentials, strengthening administrative access controls, and implementing additional safeguards for withdrawal approvals across interconnected blockchain networks. Until Initia completes its investigation and confirms that the affected infrastructure is secure, users should exercise caution when interacting with the network and avoid unofficial recovery services.

Source: CoinTrust