Initia halts L1 after compromised rollup infrastructure enables forged withdrawals
Initia says an attacker used compromised cloud credentials and reached Anvil, then validated forged withdrawals from five rollups. About $3.27 million moved from L1 escrow, including about $2.16 million still on the paused chain at the time of the update.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Initia L1 escrow holding assets bridged from the five affected rollups and dependent integrations.
- Initia · IBC · cloud credentials
- In the wild
- Yes
- Initia confirmed unauthorized escrow transfers and halted its L1.
What happened
Initia first posted a rollup incident notice and later a halt notice. In its technical update, Initia says command injection involving a compromised GCP key for private-node provisioning exposed environment variables. Credentials then let the attacker reach GitHub, GCP and Anvil, the rollup hosting platform. The resulting withdrawals unlocked assets held in L1 IBC escrow. Initia reports about $3.27 million moved to the attacker’s L1 address, about $2.16 million remained on the halted L1, and outbound transfers reached the IBC rate limits and included 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC. It says the attacker withdrew no INIT from the chain.
The moved value, assets remaining on the halted L1, outbound transfers and any future compensation are distinct. Initia plans to restore affected asset backing and says it is rebuilding affected infrastructure in isolation. It has not published final recovery amounts or a restart timetable in these notices. The described mechanism is distinct from the October MoveVM incident.
Crime-scene timeline
Nov 9, 19:30 UTC
Initia discloses a rollup-infrastructure issue
The team says rollups have paused. The L1 was still operating and the team had not identified a funds impact at that point.
Nov 10, 06:18 UTC
Validators halt the L1
The halt follows discovery of unauthorized IBC escrow transfers.
Nov 10, 16:43 UTC
Initia publishes its preliminary attack chain and asset figures
The team describes cloud and hosting credentials, five affected rollups, the retained L1 balance and restoration plans.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Initia November 9 notice, public copyPrimaryReproduces the rollup pause notice and initial assessment of user funds.
- Initia L1 halt notice, public copyPrimaryReproduces the validator halt time and preliminary escrow findings.
- Initia technical update, public copyPrimaryReproduces the preliminary intrusion chain, escrow movements, outbound assets and recovery intent.