Initia Reports Second Exploit in 3 Weeks, $3.27M Lost in Attack

Initia, a layer-1 blockchain, has confirmed it suffered a second security breach in under three weeks, with an attacker stealing about $3.27 million in digital assets after compromising the network’s cloud infrastructure. The incident follows a prior exploit on Oct. 23 that drained roughly $2.7 million.

According to Initia’s account, the attacker obtained unauthorized access on Monday via a command injection attack tied to a compromised Google Cloud Platform key. Initia says the breach exposed environment variables, enabling the actor to reach its GitHub and cloud accounts and use additional credentials to move deeper into the ecosystem.

Key takeaways

• Initia says a command injection incident involving a compromised GCP key led to access across its GitHub and cloud accounts.
• The attacker validated fraudulent IBC withdrawals from five rollups, releasing funds from Initia escrow accounts.
• Initia reports about $2.16 million in stolen assets remain frozen on its halted network.
• The network has halted operations and is working to restore the backing of affected assets.
• This comes shortly after an Oct. 23 exploit drained about $2.7 million via a vulnerability in Initia’s MoveVM script cache.

What Initia says went wrong in the second breach

In its update, Initia states the attacker’s entry point was a command injection technique that leveraged a compromised Google Cloud Platform key. Once inside, the incident exposed environment variables. Initia says those exposed variables provided access to its GitHub and cloud environments, as well as the ability to obtain further credentials.

From there, the attacker reached Anvil, a platform that hosts rollups. Initia adds that the actor then used this access to validate fraudulent Inter-Blockchain Communication (IBC) withdrawals from five rollups—triggering the release of assets held in the network’s escrow accounts.

Funds movement, asset types, and where losses stand

Initia estimates that about $2.16 million of the stolen assets are currently frozen because the network has been halted. The company also provided details on how the attacker converted and distributed some of the stolen funds.

Initia says the attacker sold assets on its decentralized exchange and withdrew specific amounts, including 13,400 TIA, 8,000 USDC, and 597,000 Noble USDC. Initia also emphasized that no INIT tokens were withdrawn.

While the exact total flows beyond the frozen portion were not fully broken down in Initia’s update, the figures it shared give investors a clearer picture of the asset mix involved—particularly the presence of multiple stablecoin units alongside TIA.

Network halt and recovery work underway

Initia said it halted the layer-1 on Tuesday. The company indicated its priority is to restore the backing of assets affected by the breach.

Initia also stated recovery efforts are ongoing with law enforcement and security partners. For users and liquidity providers, a halt typically reduces the immediate risk of further state changes or withdrawals, but it can also delay redemption and trading. That makes the timeline for restoration and how Initia will prove asset backing particularly important to follow.

Earlier exploit highlights a repeated failure pattern

The new breach comes after an Oct. 23 incident in which an attacker drained about $2.7 million following exploitation of a vulnerability in Initia’s MoveVM script cache. In that earlier case, malicious code reportedly bypassed security checks and created unbacked token balances, which were then bridged out of the network.

Taken together, the two incidents show different technical routes to loss—first through a MoveVM script cache flaw and token-balance manipulation, and now through a cloud key compromise leading to fraudulent IBC withdrawals. However, the recurring outcome is similar: attackers were able to move assets out of escrow or out of the system.

For holders, the key question is whether the underlying weaknesses are operational (such as credential handling and cloud security controls) as well as protocol-level (such as contract and execution integrity). Initia’s current account points directly to a compromised infrastructure key and exposed environment variables, suggesting the attack chain began in off-chain components before reaching on-chain settlement flows.

What readers should watch next

Investors and users should monitor how Initia quantifies total exposure across the five affected rollups, the process and timeline for restoring backing, and any public details on the incident response steps that will reduce the likelihood of repeated access-control failures. The next updates will likely matter as much for transparency as for remediation—especially in determining whether frozen funds can be safely accounted for and returned once systems are re-enabled.