Initia ($INIT) Says a Leaked Google Cloud Key Caused Its Second Hack, Loss Now Put at $3.27 Million

Published November 11, 2026, 3:37 AM PKT. Based on Initia's update on X as reported by KuCoin on November 10, 2026 (primary source), and reporting by Protos, crypto.news and The Defiant on November 10, 2026 (secondary sources).

Initia ($INIT) said on November 10, 2026 that a leaked Google Cloud Platform key caused its second hack in 18 days, and the loss is far larger than the first count suggested. About $3.27 million in assets moved to the attacker's address, Initia said in an update posted on X, and another $2.16 million sits frozen on the halted chain and cannot be moved. Together, about $5.43 million left the escrow accounts that hold assets bridged to the network's rollups.

The update answers the two questions left open when Initia halted its layer-1 blockchain at 06:18 UTC on November 10: how the attacker got in, and how much was taken. It also changes the scale of the incident. The first figure, published hours after the halt, was about $615,000 in unauthorized transfers, a number that covered only what had left the network through Noble, a separate blockchain used as a gateway for USD Coin ($USDC). The new figure is more than five times that amount.

A leaked key opened the cloud

On November 9, the attacker exploited a leaked GCP key used to configure private nodes, Initia said, and used it to run a command injection attack that gave them unauthorized access to the project's infrastructure. From there, the attacker compromised Initia's GitHub and Google Cloud accounts, obtained additional credentials, and reached Anvil, the platform that hosts the network's rollups.

That access is what made the theft possible. Using the compromised infrastructure, the attacker forged Inter-Blockchain Communication (IBC) withdrawals for five rollups, unlocking assets held in Initia's layer-1 IBC custody account. The forged transfers moved assets out of escrow accounts that were supposed to be untouchable without the rollups' own authorization.

The chain of failures runs from a single leaked credential to full control of the rollup infrastructure. A GCP key, a credential for configuring cloud servers, should never have been exposed, and once it was, it opened a path through GitHub and Google Cloud accounts to the hosting platform itself. Initia has not said where the key leaked from, how long it had been exposed, or whether the leak came from its own systems or a contractor's.

What the attacker took

After selling the stolen assets on Initia's own decentralized exchange, the attacker withdrew 13,400 Celestia ($TIA), 8,000 USDC.inj and 597,000 Noble USDC, according to the update reported by KuCoin. The attacker did not transfer any Initia ($INIT) tokens, the update said.

The $2.16 million that remains frozen sits on the paused layer-1 chain, where validators stopped block production, so the attacker cannot move it while the chain stays halted. Initia said asset recovery efforts are continuing with help from law enforcement and security partners, and that it is working with security specialists, validators and cryptocurrency exchanges to determine the incident's full scope.

The figures still carry uncertainty. The $615,000 preliminary estimate and the $636,000 counted by blockchain security firm CertiK across 16 transfers both measured only what had left through Noble in the first hours. The $3.27 million figure is Initia's own updated count of what reached the attacker's address, and the investigation remains open.

Full reimbursement, slower restart

Initia said it plans to fully reimburse the affected assets, the first commitment to repayment since the halt. The update did not say who pays, from what funds, or on what timetable, and it did not say whether reimbursement covers the $3.27 million that reached the attacker, the $2.16 million frozen on the chain, or both.

The network will also take longer to come back than a normal restart. Initia said it will rebuild its infrastructure in an isolated environment, and the restart process is expected to take longer than a standard network reboot. No restart date has been given. The chain has now been halted since 06:18 UTC on November 10, after validators coordinated the stop as a protective measure.

The delay is the cost of the attack's root cause. A restart that only switched block production back on would leave the same leaked credentials and the same compromised hosting platform in place, so the rebuild has to replace the infrastructure the attacker touched before the chain can safely resume.

Two hacks in 18 days

The November incident is Initia's second security failure in less than three weeks. On October 23, a script caching bug let an attacker spoof the state of the MoveVM, the software engine that runs Initia, and credit themselves with unbacked Wrapped Ether, iUSD and USD Coin ($USDC) balances. About $2.7 million was bridged out to Ethereum ($ETH) before validators halted the network, and full operations only resumed on November 2, after a code patch and a remediation plan. The chain had been running again for eight days when the second attack landed.

Protos reported that combined losses from the two incidents, about $3.3 million on the first count, already exceeded the chain's remaining total value locked, which is down more than 90% from its peak shortly after launch in May 2025. On the updated count, the November incident alone accounts for about $3.27 million moved to the attacker, with the October loss of about $2.7 million on top of it. Initia counts Binance Labs, Delphi Ventures and HackVC among its backers.

The market reaction has run in the opposite direction from the news. Initia ($INIT) surged about 74% in 24 hours on November 10, briefly touching $0.244 and trading around $0.22, according to KuCoin, and Protos put the gain at about 60% over the same period. No statement from Initia explains the rally, and the token rose while the chain it runs on stayed halted.

What is still missing

Four things remain unanswered. The first is where the GCP key leaked from and how long it had been exposed. The second is a restart date, which Initia has tied to a full infrastructure rebuild rather than a calendar. The third is the detail of the reimbursement plan, including who pays and when. The fourth is whether the same attacker is behind both incidents, a question no report has answered.

Until those land, the practical picture is a chain that has been stopped for more than a day, about $2.16 million frozen in place on it, about $3.27 million in the attacker's hands, and a promise of full reimbursement with no timetable attached.

Sources

• KuCoin, Initia Reports $3.27M Security Breach Due to GCP Key Leak, published November 10, 2026 (primary source: Initia's update on X, as reported by ChainCatcher; attacker exploited a leaked GCP key used to configure private nodes on November 9 to run a command injection attack; compromised GitHub and GCP accounts and accessed the Anvil rollup hosting platform; forged IBC withdrawals for five rollups; about $3.27 million transferred to the attacker's address; another $2.16 million frozen on the paused L1; attacker withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC after selling on Initia's DEX; no INIT transferred; Initia plans full reimbursement and will rebuild infrastructure in an isolated environment; restart expected to take longer than a standard reboot)
• Protos, Binance Labs-backed Initia hacked again, $3.3M lost in three weeks, published November 10, 2026 (secondary source: L1 halted 06:18 UTC November 10 in coordination with validators; compromised rollup infrastructure keys let the attacker fabricate IBC transfers; $615,000 made it off-chain on the first count; most escrow assets still on the halted L1; October 23 exploit of about $2.7 million via a MoveVM script caching bug; combined losses exceed remaining TVL, down more than 90% from peak; backers include Binance Labs, Delphi Ventures and HackVC; INIT up about 60% in 24 hours)
• crypto.news, Initia halts blockchain after $615K exploit as INIT price surges over 60%, published November 10, 2026 (secondary source: CertiK counted about $636,000 across 16 IBC transfers to Noble; INIT gained more than 60%; no restart date or reimbursement announced at the time of publication)
• The Defiant, Initia Halts L1 After $605,000 USDC Outflow, Team Says, published November 10, 2026 (secondary source: preliminary investigation pointed to compromised rollup infrastructure keys used to fabricate cross-chain transfers; about $605,000 in USDC and $10,000 in other tokens left the network)
• KuCoin, Initia Chain Halts Operations Following Security Breach; INIT Token Rises 80%, published November 10, 2026 (secondary source: L1 paused in coordination with validators as a protective measure after unauthorized transfers from custodial accounts holding assets bridged to multiple rollups; about $605,000 in USDC withdrawn via Noble plus about $10,000 in other tokens; majority of remaining assets withdrawn from custodial accounts still held on the suspended L1)

This article is news reporting and is not investment advice.