Hacked twice in 3 weeks, the Initia blockchain loses over $3 million

Home » Crypto news » Altcoins news » Hacked twice in 3 weeks, the Initia blockchain loses more than 3 million dollars

https://cryptoast.fr/initia-init-piratee-deuxieme-viens-trois-viens-blockchain-arret/

A disaster scenario is repeating itself for the Initia network. The first layer blockchain (L1), supported in 2023 by Binance Labs (now YZi Labs), then in 2024 by Delphi Ventures and HackVC, once again had to suspend its operations on November 10, 2026 at 7:18 a.m. (French time). The shutdown was decided after the detection of unauthorized transfers from its escrow accounts. The team reacted in coordination with the validators to stop the network and limit the damage.

According to initial investigations, the attacker would have exploited compromised rollup infrastructure keys (secondary blockchains backed by Initia) to create false IBC (Inter-Blockchain Communication) transfers. Approximately $605,000 in USDC stablecoin left Initia via Noble, the blockchain that manages native USDC in the Cosmos ecosystem, along with nearly $10,000 in other tokens.

The Initia teams, however, would have saved the furniture, because apart from these $615,000 of assets already gone, the majority of the other assets taken out of the escrow accounts are still blocked on the L1 at the shutdown. An initiative in collaboration with blockchain validators could thus enable their recovery.

The Initia L1 was halted at 06:18 UTC on November 10 in coordination with validators as a protective measure.

We took this step after identifying unauthorized transfers from the escrow accounts on the Initia L1 that hold assets bridged to several rollups. Our investigation is…

This new incident comes less than three weeks after a first hack, which occurred on October 23, 2026 (see the message below, published that day by Initia). A flaw in the script caching mechanism of Initia's MoveVM (the virtual machine that executes the network's smart contracts) allowed an attacker to bypass security controls with malicious code.

The hacker was thus able to falsify the state of the virtual machine and credit himself with unbacked WETH, iUSD and USDC (without any real counterpart).

At 14:59 UTC on October 23rd, an attacker exploited a bug in Initia MoveVM's script caching that allowed malicious code to bypass security checks. The attacker artificially spoofed the MoveVM state, thereby crediting themselves with unbacked WETH, iUSD, and USDC tokens without…

Machine-translated from French