Initia Gets Hacked Again: $3.27M Moved Less Than Three Weeks After The First Exploit

Initia has now been hit twice in under three weeks. The first time, the problem was a bug in its virtual machine. This time the attacker never touched the VM and walked in through a cloud key instead.

The Binance Labs-backed layer-1, built around a network of interconnected rollups, confirmed on Wednesday that an attacker moved about $3.27 million in assets out of its escrow accounts, Cointelegraph reported. Roughly $2.16 million of that is still stuck on the chain, which has been halted since Tuesday.

How The Attacker Got In

According to Initia's own breakdown on X, the intrusion started on Monday, Nov. 9. The attacker used a command injection attack together with a compromised Google Cloud Platform key. ChainCatcher, citing the same update, says it was a key used to configure private nodes. The breach exposed environment variables, and those opened up Initia's GitHub and cloud accounts plus more credentials.

Next stop was Anvil, the platform that hosts Initia's rollups. From there the attacker validated fraudulent IBC withdrawals from five rollups, and each one released assets held in the L1's escrow accounts. Initia's first statement on Tuesday described it as compromised rollup infrastructure keys that let an attacker fabricate IBC transfers, per Protos.

The attacker then sold on Initia's own DEX and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT left the chain. Initia says it plans to restore the backing of the affected assets, and that recovery work is ongoing with law enforcement and security partners.

Which Number Is Right

Depends on the day you read it. Tuesday's halt post counted $615,000 that made it off-chain, about $605,000 in USDC and $10,000 in other tokens, and said most of what left escrow was still on Initia. Wednesday's update widened the figure to $3.27 million moved to the attacker's address on the L1, with $2.16 million frozen. The withdrawn tokens listed above roughly line up with Tuesday's tally, so the two numbers appear to measure different things: what escaped the chain versus everything the attacker touched.

The combined total is just as slippery. Protos added Tuesday's $615,000 to October's $2.7 million and got about $3.3 million. Adding the new $3.27 million instead gives roughly $5.97 million across both incidents, as FinanceFeeds did. Initia has not published a final accounting for either.

The First Exploit, Three Weeks Earlier

On Oct. 23 Initia halted its L1 and rollups at 3:41 p.m. UTC. Security researcher Spreek flagged the exploit first, reporting unauthorized token minting. D2 Finance then traced the damage: 2 million unbacked AUSD, with about 1.4 million AUSD, 105 ETH and 1.08 million USDC bridged to Ethereum and consolidated into a wallet holding around 1,135.5 ETH, worth $2.73 million at the time.

Initia's Oct. 24 update pinned it on a script caching bug in MoveVM that let the attacker spoof chain state and credit themselves with unbacked WETH, iUSD and USDC. The network came back on Nov. 2. It lasted eight days.

Reaction

Users were not gentle. Per Protos, one account urged the chain to shut down, and another accused the team of an inside job. I could find nothing published that supports the inside-job claim, so treat it as an accusation and nothing more.

The weirder part is the chart. INIT rose around 60% in the 24 hours after the halt, according to Protos and crypto.news, on a chain where nothing could be moved. One user on X suspected a "crime pump". Protos also notes that Initia's TVL, per DefiLlama, is down more than 90% from its peak after the May 2025 launch, and that losses from the two incidents now exceed what is left on the chain.

What I Keep Coming Back To

The two exploits share no technical overlap. October hit the execution layer. November hit the cloud account behind it. Initia's pitch is app-specific chains linked by IBC, and that design creates a lot of places where trust has to hold. FinanceFeeds makes the point that one compromised cloud key was enough to cross several of those boundaries at once.

That is my read too, and it is uncomfortable. A fix for a VM bug, even an audited one, does nothing about a leaked credential that can sign off on withdrawals from five rollups. The team spent ten days patching the first problem and got eight days of uptime before the second one found them.

Initia says it will rebuild the affected infrastructure in an isolated environment and that the restart will take longer than a normal reboot. As of Wednesday there is no restart date. Until there is, nothing moves on the L1 or its rollups, including the $2.16 million sitting frozen.