Initia, a layer-1 blockchain supporting connected rollups, confirmed on Wednesday that an attacker moved approximately $3.27 million in crypto assets after gaining unauthorized access to its cloud infrastructure. Roughly $2.16 million of those assets remain frozen on the halted network. The incident marks the second major disruption for the project in less than three weeks.

How the Latest Breach Unfolded

According to Initia, the attacker obtained access on Monday through a command injection attack that used a compromised Google Cloud Platform key. The breach exposed environment variables, which allowed further entry into the project's GitHub and cloud accounts and the acquisition of additional credentials. From there, the attacker reached Anvil, the platform hosting Initia's rollups, and validated fraudulent Inter-Blockchain Communication withdrawals from five rollups. This released assets held in the network's escrow accounts.

The attacker sold some assets on Initia's decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. No INIT tokens were withdrawn. Initia halted its layer-1 blockchain on Tuesday in coordination with validators to stop further unauthorized activity. Recovery efforts continue with law enforcement and security partners, and the project has stated it intends to restore the backing of affected assets.

Earlier Signs of Trouble

On November 9, Initia had already coordinated temporary pauses across affected rollups while investigating an infrastructure issue. At that stage the layer-1 network remained online, and the team reported no impact to user funds. Services including the Initia Scan block explorer experienced reduced performance. The subsequent investigation identified the unauthorized escrow transfers that prompted the full network halt the next day.

Preliminary figures released around the November 10 halt placed the unauthorized transfers at roughly $615,000, consisting of about 605,000 USDC and other tokens valued near $10,000 that left through Noble. Blockchain security firm CertiK reported approximately $636,000 across 16 successful IBC transfers. Later updates raised the total moved to about $3.27 million, with the majority of remaining assets still on the halted chain.

October Exploit and Recovery

The November events follow an October 23 incident in which an attacker exploited a vulnerability in Initia's MoveVM script-caching system. Malicious code bypassed security checks and created unbacked token balances that were then bridged out of the network. Approximately $2.7 million left the ecosystem, including 105 WETH, roughly 1.4 million AUSD0 and about 1.08 million USDC. The attacker later exchanged the assets for 1,135.52 ETH on Ethereum. No native INIT tokens were minted, leaving the token's total supply unchanged.

Validators halted the network after the October exploit. Following security work and a MoveVM patch, operations resumed on November 2. The rapid succession of two separate incidents has forced repeated protective pauses and ongoing investigations into both the technical vulnerabilities and the methods used to obtain infrastructure credentials.

Market Response

Despite the network suspensions, the INIT token recorded sharp gains. Data showed the token rising more than 60 percent over a 24-hour period around the November halt, moving from near $0.12 to levels above $0.23 at points during the session. Trading volume reached approximately $84.81 million, with a circulating supply near 220 million tokens. Market capitalization stood around $46 million during the surge. Prices later fluctuated as details of the second exploit emerged.

Initia continues to work with validators, security specialists and exchanges to determine the full scope of the unauthorized transfers and to restore normal operations. The project has cautioned users against unofficial recovery claims or links circulating during the investigation and said further details will be shared as they become available.