If assets you hold can sit in a chain’s IBC escrow, an operator’s infrastructure failure is a different problem from misplacing a seed phrase you control. Access that lets a team configure nodes is not the same as keeping those keys confidential, and pausing a chain is not the same as getting funds back.
On November 11, 2026, PANews reported that Initia had posted on X with an update from its security-incident investigation. The report says the attacker acted on November 9, using leaked Google Cloud Platform (GCP) keys that were used to configure private nodes. Through a command-injection attack, the attacker reached Initia infrastructure without authorization.
The disclosure, as relayed by PANews, describes a widening set of credentials rather than one stolen personal wallet. The attacker obtained Initia’s GitHub and GCP accounts and further credentials, and gained access to Anvil, the rollup hosting platform. With that access, forged IBC withdrawals were validated for five rollups, unlocking assets in Initia’s layer-1 IBC escrow account.
PANews gave two figures, and they should stay separate. About $3.27 million in assets was transferred to attacker addresses. Another $2.16 million, also described as stolen funds, remained on the layer 1, which had been paused, and could not be transferred. The report does not name the five rollups, list attacker addresses, or say how the GCP keys were first exposed.
For a holder tracking assets on this path, the checks supported by the report are limited and concrete. Keep the dates distinct: the intrusion described is November 9, 2026, and PANews published this account on November 11, 2026, at 03:56 (UTC+8). Treat the amount already moved and the amount left on the paused layer 1 as different totals. A pause can stop further transfer of what remains; it does not reverse what has already left the escrow. The report does not say that a personal backup, a hardware wallet, or any particular holding mix would have prevented this infrastructure compromise. No custody setup removes every risk of this kind.
This article only restates that PANews report. It does not add later developments.
Original report: PANews, November 11, 2026
