Initia hack: compromised cloud key drains $3.27 million and halts the blockchain

The layer-1 blockchain Initia has been attacked for the second time in three weeks. This time the weak point was not the blockchain’s code but the project’s cloud infrastructure: using a compromised Google Cloud key, an attacker gained access to internal systems and approved forged withdrawals from five rollups. According to Initia, around $3.27 million was moved this way, about $2.16 million of which sits frozen on the halted blockchain. The network has been at a standstill since Tuesday, November 10.

Anyone holding INIT or tokens on one of the Initia rollups cannot move anything on-chain for now. What matters most for investors at this point is where their own coins are held, which announcements are genuine, and how to avoid the fake refund sites that reliably appear after incidents like this.

Initia hack: what happened on November 9 and 10

The sequence of events can be pieced together from the project’s statements and a Cointelegraph report of November 11. On Monday, November 9, the attacker gained access to Initia’s infrastructure. The project itself wrote on X (account @initia) on November 10 that an attacker had “gained unauthorized access to Initia’s infrastructure through a command injection attack” on November 9.

On Tuesday, validators stopped block production on the layer-1 blockchain. The halt made it possible to hold on to part of the loot, because no one can transfer assets on a stopped blockchain, the attacker included. On Wednesday, Initia confirmed the higher damage figure of $3.27 million. The first estimates on Tuesday had been considerably lower, because at first only the outflows that had already left the blockchain were visible.

Who is affected

The direct targets were the escrow accounts of five rollups. An escrow account is an on-chain custody account that holds the backing for tokens sent back and forth between two networks. If someone empties such an account, the tokens on the other side lose their backing. Initia stresses that no INIT tokens were taken; the assets affected are bridged assets such as USDC and TIA.

Command injection and a Google Cloud key: the attack path

Command injection is an attack in which a system executes commands that an attacker has smuggled into an input. In Initia’s case, according to Cointelegraph, the attack exploited a compromised key for Google Cloud Platform. According to Initia’s account, reported among others by CoinCentral, the key was actually meant for setting up private nodes.

With that access, the attacker reached environment variables. These are configuration values in which software often stores passwords and access keys. They opened Initia’s GitHub and cloud accounts as well as further credentials. The end point was access to Anvil, the platform on which the network’s rollups run.

A rollup is a separate blockchain that bundles transactions and borrows its security from a parent chain, in this case the Initia network. Whoever controls the rollup infrastructure can confirm operations that should never have taken place. That is exactly what happened: the attacker confirmed forged IBC withdrawals from five rollups.

IBC stands for Inter-Blockchain Communication, the transfer protocol of the Cosmos ecosystem that moves tokens between independent blockchains. An IBC withdrawal releases assets from an escrow account as soon as the other side confirms the transfer. If an attacker does the confirming, money flows out with no real counter-entry.

$3.27 million from five rollups: the damage in numbers

The attacker sold part of the released assets on Initia’s decentralized exchange and, according to Cointelegraph, withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. TIA is the token of the Celestia network; USDC.inj and Noble USDC are versions of the USDC stablecoin on the Injective and Noble blockchains.

Of the total of around $3.27 million, about $2.16 million is still frozen on the halted network, according to Initia. On paper, that means a little over $1 million has actually left the Initia ecosystem. Whether the frozen assets can be fully secured depends on how the network restart is handled.

So far the figures come solely from the project itself; no independent post-mortem by a security firm has been published yet. Initia says it is working with law enforcement and security partners but has not named them.

Second exploit in three weeks: how it differs from the MoveVM bug of October 23

The attack is already the second incident at Initia in quick succession. On October 23, an attacker exploited a bug in the script cache of the MoveVM, the virtual machine in which Initia’s smart contracts run. At the time, unbacked token balances were created and, according to Cointelegraph, around $2.7 million flowed out. We covered the first case in our report on the network halt after the infinite mint.

Technically, the two incidents have little in common. In October the bug was in the protocol, meaning code anyone can inspect publicly. In November the weakness lay in the operating environment: cloud accounts, access keys and internal tools. For holders the outcome is similar all the same, because in both cases the network had to be halted. Initia has not said whether the same attacker is behind both cases.

Why two incidents weigh more than one

A single exploit can happen to any young network. Two incidents within three weeks, in two different layers, raise questions about internal processes: how keys are managed, who has access to production systems, and how quickly the team spots unusual withdrawals. Answers will only come from a detailed review, which Initia has not yet published.

INIT price after the hack: up 102 percent in seven days

The market’s reaction is unusual. According to CoinGecko, INIT traded at around $0.26 on Wednesday morning, roughly €0.23. That is a good 20 percent more than 24 hours earlier and around 102 percent more than a week ago. Market capitalisation stood at about $57 million. Despite the jump, the price is still far from its record high of $1.42 from May 2025.

Neither the project nor the trade press gives a documented reason for the rise. Price moves in tokens with a small market capitalisation after hacks often come from short positions being covered or from short-term bets on a recovery. That is an assessment, not evidence. For investors it mainly means that a price jump like this is no signal that the incident is over.

According to CoinGecko, INIT trades on Binance, Kraken, Bitvavo, Bybit and Bitget, among others. As long as the blockchain is halted, INIT deposits and withdrawals on exchanges depend on how each platform handles the situation. Your exchange’s status page shows the current state. If you want to trade INIT, do so on a platform licensed under MiCA; our comparison of regulated crypto exchanges gives an overview.

Network halt and backing: what Initia promises for affected tokens

Initia has announced that it will restore the backing of the affected assets. This means tokens on the rollups should again be fully backed by counter-values in the escrow accounts. How that will happen, for instance from the project’s own funds or from recovered money, is not known. The statements so far give no date for the network restart.

Until then, anyone holding tokens on the Initia blockchain or one of its rollups cannot move them, not even to safety. That is inconvenient, but it also stops the attacker from moving the frozen $2.16 million onwards. Anyone holding INIT on a centralised exchange, by contrast, is only indirectly affected by the halt: trading on the exchange can continue, but deposits to and withdrawals from the network cannot.

How to protect yourself from fake refund sites after the Initia hack

What happened: On November 9, an attacker broke into Initia’s infrastructure using a compromised Google Cloud key and approved forged IBC withdrawals from five rollups. According to Initia, around $3.27 million was moved, and about $2.16 million is frozen on the network, which has been halted since November 10 (as of November 11).

Are you affected? You may be affected if you hold tokens on the Initia blockchain or its rollups, especially bridged assets such as USDC or TIA. If you only hold INIT on an exchange, you are not directly affected, but you cannot withdraw INIT to the network until the restart. Initia has not yet publicly specified which five rollups were hit, so follow the project’s announcements on its official channels.

1. Official channels only: Read news about the restart only on Initia’s website, saved as a bookmark, and on its verified X account, never via links from chats or replies under posts.
2. No refund forms: Do not fill in any “claim” or “refund” form that asks you to connect your wallet unless Initia itself has announced a procedure.
3. Clean up approvals: Use a tool such as Revoke.cash to check which token approvals your wallet has granted to Initia applications and bridges, and revoke any you no longer need.
4. Don’t force transfers: Do not try to pull tokens out of the halted network through unofficial bridges or services; anyone offering that is usually after your recovery phrase.
5. Separate your holdings: Keep larger amounts on a hardware wallet and use a separate wallet with a small balance for experiments with young networks, so that an incident never reaches all of your assets.

Our guide on how to store crypto safely explains the basics of secure custody, and the hardware wallet comparison lines up suitable devices.

Cloud keys as a gateway: why infrastructure is becoming a risk for blockchains

The Initia case is part of a series of attacks in which the smart contract stays intact and its surroundings fail. Only this week, the Across bridge reported a hijacked domain that sent users to a rigged site. At Initia it was a cloud key. In both cases, auditing the code alone would not have helped.

For investors that is an uncomfortable finding. An audit seal says something about the audited code, but nothing about how a team manages its passwords, keys and servers. Young networks with their own rollups in particular run a lot of infrastructure themselves, and every component is a potential point of attack. The more parts a system has, the more keys there are that can be lost.

One sign of professionalism is therefore how openly a project reports after an incident. Initia described the attack path comparatively early. A full review with a timeline and countermeasures is still outstanding, though, and that is the yardstick by which the project will have to be measured.

Initia hack: no restart date, so the network stays frozen

As long as Initia gives no date for the restart, tokens on the network stay locked and any announcements about refunds should be read with caution. Three things make sense now:

1. If you want to buy or sell INIT, use an exchange licensed in the EU; the comparison of regulated crypto exchanges shows which providers hold a MiCA licence.
2. Larger holdings are better kept on your own hardware wallet than on young networks; you will find suitable devices in the hardware wallet comparison.
3. For DeFi experiments, a separate wallet with a small balance is the right tool; the software wallet comparison shows which apps suit the purpose.

(As of November 11, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)