Initia rollup infrastructure (November 2026) hack — November 2026

Initia, a layer-1 blockchain whose L1 escrows assets bridged to its rollups, suffered its second exploit in under three weeks. On 9 November 2026 an attacker got into Initia's infrastructure through a command injection attack with a compromised Google Cloud key used for provisioning private nodes. Exposed environment variables gave access to Initia's GitHub and Google Cloud accounts and further credentials, including Anvil, the platform that hosts Initia rollups. Using it, the attacker validated forged IBC withdrawals from five rollups and released the assets held in the L1's escrow accounts. Validators halted the L1 at 06:18 UTC on 10 November.

Initia says about $3.27 million of assets moved to the attacker's L1 address (the headline here). The attacker sold some on the Initia DEX and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC before hitting Initia's outbound IBC rate limits; Initia's first estimate of what left the chain, about $615,000, is the low end. No INIT was withdrawn. About $2.16 million of the stolen assets remains on the halted L1, where it cannot be moved; it is not counted as recovered until it is returned to the escrows.

Initia says it intends to restore the backing of the affected assets in full, which would be compensation, and is rebuilding the affected infrastructure. Recovery efforts are under way with law enforcement. The earlier Initia exploit, of its MoveVM script cache on 23 October, is a separate entry.