Initia Cloud Breach Triggers Forged IBC Withdrawals Across Five Rollups

15/11/2026 admin

Key Takeaways:

After successfully breaching Initia’s cloud environment, an attacker made around $3.27 million.
However, around $2.16mn is stuck on paused Layer 1, and isn’t moving any further on Initia.
The attacker siphoned 5 amounts of IBC withdrawals from five rollups, and according to Initia, it will rebuild the funds of affected assets in full.

User Score

8.7

Initia has revealed new information regarding breaches on its cloud credentials that led it to infrastructure of rollups on its Layer 1. It’s the second time that Initia has suffered a big security breach in three weeks, following an unrelated exploitation in October.

Based on our investigation so far, on November 9th an attacker gained unauthorized access to Initia’s infrastructure through a command injection attack with a compromised GCP key used for provisioning private nodes. This exposed environment variables, which allowed the attacker to access our GitHub and GCP accounts and obtain further credentials.
With these credentials the attacker gained access to Anvil, the hosting platform used by rollups on Initia. Through this the attacker was able to validate forged IBC withdrawals from five rollups, unlocking assets held by the Initia L1’s IBC escrow accounts.
Around $3.27m of assets were moved to the attacker’s Initia L1 address with $2.16m of the stolen funds remaining on the paused L1 where they cannot be moved. The attacker sold stolen assets on the Initia DEX and then withdrew 13.4k TIA, 8k USDC.inj, and 597k Noble USDC reaching Initia’s outbound IBC rate limits. No INIT was withdrawn from Initia by the attacker.
We intend to restore the backing of affected assets in full. We are finalizing the plan and will share the details once it is confirmed.
As a precaution, we are rebuilding the affected infrastructure from scratch in an isolated environment, enforcing least-privilege access controls, and hardening security at every layer of the stack from cloud infrastructure to onchain IBC validation. Given the above, we expect this process to be longer than a routine network restart. We will share timelines as they become available.
All announcements will be made through Initia’s official channels. Thank you for your patience.
— Initia 🪢 (@initia) November 10, 2026

Compromised GCP Key Opened the Door

The compromise was performed on Nov. 9 using an Initia-provisioned key on Google Cloud Platform to gain control of the private nodes through command injection, Initia found.

The access exposed environment variables, which were then used to access Initia’s GitHub and GCP accounts to gain further access. The attacker then connected to the Initia hosting platform rollups use (Anvil).

Subsequently, fraudulent Inter-Blockchain Communication withdrawals were then double-validated on five rollups before the assets were untethered on Initia’s Layer 1.

Forged IBC Withdrawals Released $3.27M

Nearly $3.27 million worth of assets were sent to the attacker’s L1 address, Initia noted.

The attacker then sold some of the stolen assets through Initia’s decentralized exchange and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC before hitting the network’s outbound IBC rate limits.

Importantly, Initia said the withdrawal of INIT tokens did not occur. There are over $2.16 million in assets on Layer 1 that aren’t transferable at this time.

Initia Rebuilds Infrastructure Before Network Restart

Initia said it plans to completely recover the backing of any impacted assets and is developing a recovery plan.

In addition to the usual switch on, the team is rebuilding the damaged infrastructure from the ground up in an isolated environment. It additionally hopes to implement more rigorous least-privilege access controls and improve security in its cloud systems by on-chain IBC validation.

The network might stay off for an extended time, then, as during an ordinary disruption. They are also continuing with their asset recovery with Law Enforcement and Security partners.

The leak comes after a hackers exploit on Oct. 23 which saw the attackers defraud around $2.7 million from the company using a MoveVM script cache vulnerability. That earlier incident enabled credentials to be created and cross-chain withdrawals made without any authorization prior to the network being paused.

The two attacks were different in that the former was based on migration issues involving the blockchain execution logic and the current attack led to an off-chain breach of cloud infrastructure and was only recognised by its entry into rollup or IBC systems.

The post Initia Cloud Breach Triggers Forged IBC Withdrawals Across Five Rollups appeared first on CryptoNinjas.

CryptoNinjas