Less than three weeks after its previous exploit, Layer-1 blockchain network Initia was breached once again. Developers confirmed the theft of approximately $3.27 million across various crypto assets in the latest incident. The attack took place after the perpetrator infiltrated vulnerabilities within the project’s cloud computing infrastructure.
The attack began on Monday, November 9, 2026. The perpetrator exploited a command injection vulnerability using compromised Google Cloud Platform (GCP) access keys. The leaked cloud keys exposed system environment variables, providing entry into Initia’s GitHub account and computing infrastructure to harvest additional credentials.
How the Attacker Drained Five Rollups
Armed with additional credentials from the cloud system, the attacker breached Anvil, Initia’s rollup hosting platform. From there, the hacker authorized forged Inter-Blockchain Communication (IBC) withdrawals across five different rollups to unlock assets held in escrow.
After triggering the fraudulent withdrawals, the attacker swapped a portion of the assets on Initia’s decentralized exchange (DEX). Through these swaps, the perpetrator withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC. Meanwhile, not a single native INIT token was withdrawn by the attacker.
$2.16 Million Freeze and History of MoveVM Vulnerability
In response to the attack, developers decided to temporarily shut down the network. On Tuesday, November 10, 2026, Initia Layer-1 operations were completely halted. This shutdown effectively froze roughly $2.16 million worth of stolen funds directly on the Initia chain before they could be laundered or transferred away.
The incident follows a similar exploit on October 23, 2026, which resulted in a $2.7 million loss. In that previous event, the attacker exploited a MoveVM script cache vulnerability that enabled minting new tokens without collateral backing.
The two breaches in less than three weeks highlight two distinct vulnerabilities, ranging from MoveVM code logic flaws to off-chain cloud credential leaks. While developers managed to freeze $2.16 million of the stolen funds by halting the network, the remaining assets that were successfully withdrawn serve as a stark reminder of the security risks facing multi-rollup ecosystems.
Via Cointelegraph.
Also read: What Is DeFi (Decentralized Finance)?
Also read: Transaction Routing Hits $1.3 Trillion, Jupiter Unveils Four New Products Ahead of Solana Breakpoint
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
