Initia discloses security incident: attacker used leaked GCP key to steal about $3.27 million in assets
Initia posted on X to disclose progress in its investigation into the security incident, saying that on November 9 the attacker used a leaked GCP key, which was used to configure private nodes, to illegally access Initia’s infrastructure through a command injection attack, then obtained access to its GitHub and GCP accounts and more credentials, and gained access to the rollup hosting platform Anvil, using that access to forge IBC withdrawals for five rollup verifications and unlock assets in Initia L1’s IBC custodial account. About $3.27 million in assets were transferred to the attacker’s address, while another $2.16 million in stolen funds remain on the paused L1 and cannot be moved.
After selling the stolen assets on the Initia DEX, the attacker withdrew 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC, without transferring any INIT. Initia said it plans to fully restore the affected assets and will rebuild its infrastructure in an isolated environment, with the restart expected to take longer than a normal network restart; asset recovery work is still continuing with assistance from law enforcement and security partners. Earlier reports said Initia L1 had already been suspended at 06:18 UTC on November 10 (about 14:18 Beijing time).
Original source:
Title: Based on our investigation so far, on November 9th an attacker gained unauthorized access... Publisher: Initia (official account @initia) Publication date: 2026-11-10 URL: https://x.com/initia/status/2120195620442910943 Source nature: official project statement Verification status: the full original post and thread were actually read in this instance (2026-11-10) Supported content: supports the attack path (leaked GCP key, command injection, access to Anvil, forged IBC withdrawals for five rollups), about $3.27 million transferred out, $2.16 million left on the paused L1, the attacker withdrawing 13.4k TIA and other assets without transferring INIT, as well as the full recovery plan and infrastructure rebuild arrangement.
ABAB AI Insight
On November 10, Initia disclosed that on November 9 an attacker used a leaked GCP key to launch a command injection attack against the private-node configuration environment, then obtained GitHub and GCP accounts and other credentials, and accessed the rollup hosting platform Anvil. Using that access, the attacker forged IBC withdrawals for five rollup verifications and unlocked assets from Initia L1’s IBC custodial account. About $3.27 million was transferred to the attacker’s L1 address, while another about $2.16 million remained on the paused L1 and could no longer be moved.
The attacker then sold the stolen assets on the Initia DEX and withdrew 134,000 TIA, 8,000 USDC.inj, and 597,000 Noble USDC, triggering outbound IBC rate limits, but did not transfer any INIT. Initia said it plans to fully restore backing for the affected assets and rebuild the affected infrastructure from scratch in an isolated environment, strengthening least-privilege controls and security measures at each layer, and the restart is expected to take longer than a normal network restart.
This was Initia’s second security incident in less than three weeks. On October 23, the network suffered about $2.7 million in losses due to a MoveVM script cache vulnerability, after which the network was suspended and restarted on November 2. This incident involved infrastructure keys and forged IBC withdrawals, different from the contract-layer vulnerability path in the previous case. L1 was suspended at 06:18 UTC on November 10 as a protective measure.
Initia’s response includes a commitment to full restoration, infrastructure reconstruction, and cooperation with law enforcement to recover assets. Because most of the stolen funds remain on the paused chain, there is some possibility of recovery through validator coordination, but the portion that has already been moved out, especially assets routed through Noble, will be harder to recover. Key follow-up items are the official details of the restoration plan, the infrastructure rebuild timeline, and progress in actually recovering assets.
ABAB News · Law of cognition
Leaking infrastructure keys can allow attackers to forge cross-chain messages, thereby extracting assets from custodial accounts.
After a network is paused, stolen assets left on-chain are more likely to be recovered through validator coordination than assets that have already been bridged out.
When a project suffers consecutive security incidents through different attack paths in a short period, the restart and rebuild cycle usually becomes significantly longer.