Initia hack: cloud key exploit drains $3.27 million

The layer-1 blockchain Initia has been attacked for the second time in three weeks. This time the weak point was not the blockchain’s code but the project’s cloud infrastructure: using a compromised Google Cloud key, an attacker gained access to internal systems and approved forged withdrawals from five rollups. According to Initia, around $3.27 million was moved this way, about $2.16 million of which sits frozen on the halted blockchain. The network has been at a standstill since Tuesday, November 10.

Anyone holding INIT or tokens on one of the Initia rollups cannot move anything on-chain for now. What matters most for investors at this point is where their own coins are held, which announcements are genuine, and how to avoid the fake refund sites that reliably appear after incidents like this.

Initia hack: what happened on November 9 and 10

The sequence of events can be pieced together from the project’s statements and a Cointelegraph report of November 11. On Monday, November 9, the attacker gained access to Initia’s infrastructure. The project itself wrote on X (account @initia) on November 10 that an attacker had “gained unauthorized access to Initia’s infrastructure through a command injection attack” on November 9.