Layer-1 blockchain Initia has confirmed its second security breach in under three weeks, after attackers gained control of roughly $3.27 million in cryptocurrency assets. According to the project, the latest exploit stemmed from compromised cloud credentials that enabled unauthorized withdrawals from accounts holding assets bridged across the network.

Initia halted its blockchain on November 10, 2026, to prevent further losses. The team confirmed that approximately $2.16 million of the compromised assets remains frozen on the suspended network, limiting the attacker's ability to move additional funds.

Compromised Cloud Credentials Enabled the Breach

Initia's investigation found that the attacker obtained unauthorized infrastructure access on November 9 through a compromised Google Cloud Platform (GCP) key. Using a command injection vulnerability, the intruder exposed sensitive environment variables and harvested additional credentials.

Those credentials granted access to Initia's GitHub and cloud accounts before the attacker reached Anvil, the platform hosting Initia's rollups. The attacker then forged Inter-Blockchain Communication (IBC) withdrawals across five rollups, unlocking assets held in the blockchain's escrow accounts, as documented in a Binance Square post.

In total, approximately $3.27 million was transferred to an address on Initia's network. The blockchain shutdown, however, prevented the movement of roughly $2.16 million of those assets, leaving approximately $1.11 million of the transferred total outside the frozen sum.

Second Attack Within Weeks

The incident follows an October 23 exploit that caused approximately $2.7 million in cryptocurrency losses. That earlier attack targeted a vulnerability in Initia's MoveVM implementation, which allowed unauthorized token balances to be created and transferred. Initia temporarily suspended operations after the October incident and restored network activity on November 2, only to suffer another significant breach eight days later.

The two incidents followed different playbooks: the October attack targeted a flaw in Initia's on-chain MoveVM code, while the latest began with a compromised cloud key — a reminder that infrastructure credential management is a distinct attack surface from smart contract security, and one that code-level fixes alone do not address.

During the latest attack, the exploiter withdrew approximately 13,400 TIA tokens, 8,000 USDC.inj, and 597,000 Noble USDC. Initia confirmed that no native INIT tokens were taken, meaning the losses fell on bridged assets held in the network's escrow accounts rather than on its own token.

Recovery Plans and Infrastructure Overhaul

Initia said it intends to fully restore the reserves backing the affected assets while continuing recovery efforts alongside security specialists and law enforcement. The project has not announced a specific timeline for completing the process.

The development team is rebuilding the compromised infrastructure within an isolated environment and strengthening access controls. It also plans to improve verification mechanisms for cross-chain transactions to reduce the risk of similar attacks. As a result, the network's restart will take longer than a routine recovery. Until then, the frozen funds remain locked on the suspended chain, and the restart timeline, the pace of reserve replenishment, and any movement of funds from the attacker's address are the key developments to watch.

The back-to-back exploits underscore the risks associated with compromised infrastructure credentials and the management of cross-chain assets — risks that extend beyond Initia itself, as cloud-managed infrastructure and bridge escrow accounts are common building blocks across multi-chain ecosystems.