Initia's Second Exploit: The Attacker's Initia Key Also Signs on Ethereum, Where 605,542 USDC Became 284 ETH and Split Ten Ways

BlockintAI · 2026-11-11T21:00:00.000Z

Initia halted its L1 at 06:18 UTC on November 10 (12:18 AM CST). It was the project's second exploit in three weeks. Initia's statement, published on X and also reported by Cointelegraph, Tree News and Chaincatcher, says that on November 9 an attacker used a compromised Google Cloud (GCP) key and a command-injection bug to reach Initia's GitHub and cloud accounts. From there the attacker got into Anvil, the platform that hosts Initia rollups, and forged IBC withdrawals from five rollups. Those forged withdrawals released assets held in bridge escrows.

Initia puts the total moved at about $3.27 million. It says $2.16 million of that is still sitting on the halted L1. Before the halt, the attacker withdrew 13.4k TIA, 8k USDC.inj and 597k Noble USDC. No INIT was taken. Initia's first public figure was lower, about $605k plus $10k. CertiK flagged roughly $636K leaving for Noble in 16 transfers.

This post follows the money that left before the halt. The trail mostly runs through one detail: the attacker's Initia address and an Ethereum wallet are controlled by the same key.

The timeline Initia's users saw

By 1:30 PM, when the "no impact identified" message went out, the first Noble transfer was already 28 minutes old. By the halt, all 16 transfers had landed. 605,027.30 USDC had already reached the attacker's wallet on Ethereum.

Sixteen transfers to Noble

The attacker's Initia address is init1nyn989pkt2tx3rfz4rhzwldlh67vy4t30ccyz9. Initia's own chain can't be queried while it is halted. The receiving side is public, though. We pulled every IBC packet Noble accepted from that sender.

We counted 16 receipts totaling 636,969.161693 USDC between 1:01:38 PM and 11:51:56 PM CST on November 9. That matches CertiK's count. The packets named three Noble recipients:

Both personal recipients were brand-new Noble accounts. noble1utl0…8gp is now empty. noble1zwr7…mr3 holds 0.30 USDC.

The packet memos show where the money was meant to go next. Several carry a forward instruction: hop to Osmosis, swap through a Skip swap_and_action contract, then send the output over IBC to inj1nyn989…80nml on Injective. One memo carries a CCTP instruction through Noble's Orbiter module that names an Ethereum mint recipient directly: 0x99265394…5571.

One key, three chains

Decode the bech32 addresses and the link is plain. init1nyn989…, inj1nyn989… and the Ethereum address 0x9926…5571 all encode the same 20 bytes: 99265394365a96688d22a8ee277dbfbebcc25571.

CertiK notes that the Initia address uses an ethsecp256k1 key. Accounts like that derive their address the same way Ethereum does. Injective accounts do the same. So whoever signed the Initia withdrawals also holds the key to the Ethereum wallet. The attacker didn't hop to a fresh identity on the way out. They sent the money to their own key on each chain.

605,542.85 USDC arrives on Ethereum

Between 1:39:23 PM CST on November 9 and 2:28:47 AM on November 10, 0x9926…5571 received 605,542.852586 USDC by three routes:

Our on-chain review identified this as a slightly different figure from Initia's "597k Noble USDC." That figure counts what left the Initia side. Ours counts what reached Ethereum, after the swap and Injective hops and their fees.

The wallet got its gas at 1:19:23 PM from 0xab94096a…8ba7, an unlabeled address. That was 18 minutes after the first Noble transfer, and before any USDC had arrived.

USDC to ETH, then one wallet

The wallet converted almost all of the USDC to ETH in a few hours:

The Uniswap swaps each landed as WETH. The wallet unwrapped each of the four big ones within a minute. Two small post-halt mints (16.20 and 499.34 USDC) went the same way.

The ETH then went to a single address, 0xf8f97cef…b23e, in five sends totaling 284.132440773 ETH:

After the sends, an address-poisoning bot sent 0x9926…5571 a string of 0.0000000001 ETH dust transfers from a lookalike, 0xf8f9b0d7…a5b23e, that shares the first and last characters of 0xf8f9…b23e. They are trying to get the attacker to copy the wrong address next time. We left those dust transfers out of every total here.

The ten-way split

At 7:23:11 AM CST on November 10, 0xf8f9…b23e sent 284.011 ETH to a contract verified on Etherscan as ProxyForMctMultisender (0x005da414…6666). That contract paid out ten transfers of exactly 28.4001 ETH (284.001 ETH in all), each to a new address. The remaining 0.01 ETH was not paid out in those transfers. Tx: 0xd4583a90e5476eb6127cd44095db0f5a80dcf5f51f2ec5244f7adc57591385ef

All ten addresses were emptied within 40 minutes:

• Three sent their 28.4 ETH to three different unlabeled addresses between 7:27:47 and 7:29:35 AM.
• The other six sent theirs into the tenth split address, 0x7d484758…8d5a, between 7:56:35 and 8:02:35 AM.

From 8:07:11 to 9:08:47 AM, 0x7d48…8d5a sent ETH onward to four addresses, including 158.9 ETH and 178.92 ETH in single sends. Those outflows add up to more than the 198.8 ETH it got from the split. It had other ETH too, so we don't treat its outflows as the Initia money alone.

0x9926…5571 now holds 0.000022 ETH. All the ETH that the Initia proceeds bought on Ethereum has left it.

What's left to recover

Per Initia, $2.16 million is stuck on the halted L1, and Initia plans to restore backing for the affected assets. Everything traced above left before the halt and moved on chains Initia doesn't control:

• the Noble USDC
• the Injective hop
• the CCTP mints
• the 284 ETH and its ten-way split

The best leverage now sits with the exchanges and services where the split ETH lands next.

What to watch

• 0xf8f9…b23e and 0x7d48…8d5a: the first ETH collection point, and the address where six of the ten split payments merged.
• The three single-hop recipients of the 28.4 ETH payments. Any one of them reaching a labeled exchange deposit would be the first cash-out point.
• inj1nyn989…80nml on Injective. It now holds about 0.257 INJ. Any new USDC there would mean a second round.
• New CCTP mints to 0x9926…5571 from Injective or Noble.

Sources

• Initia (@initia), investigation statement, November 10, 2026, 10:43 AM CST: https://x.com/initia/status/2120195620442910943
• Initia (@initia), L1 halt and preliminary figures, November 10, 2026, 1:07 AM CST: https://x.com/initia/status/2120050740626628972
• Initia (@initia), rollup-infrastructure investigation, November 9, 2026, 1:30 PM CST: https://x.com/initia/status/2119875372183703612
• CertiK Alert (@CertiKAlert), ~$636K across 16 IBC transfers to Noble, November 10, 2026, 4:28 AM CST: https://x.com/CertiKAlert/status/2120101370909151548
• CertiK Alert (@CertiKAlert), Noble recipient split, November 10, 2026, 4:29 AM CST: https://x.com/CertiKAlert/status/2120101659565342852
• CertiK Alert (@CertiKAlert), same ethsecp256k1 key, November 10, 2026, 8:33 AM CST: https://x.com/CertiKAlert/status/2120163037126836292
• Cointelegraph, "Initia Suffers Second Crypto Exploit in 3 Weeks, $3.27M Moved": https://cointelegraph.com/news/initia-second-crypto-exploit-three-weeks
• Tree News, Initia investigation statement: https://tree.news/news/based-on-our-investigation-so-far-on-november-9th-an-attacker-gained-g3wamdqv0bfj
• cybersixt, Initia halt timeline: https://cybersixt.com/originals/initia-halts-its-l1-again-after-605-000-leaves-bridge-escrows
• Chaincatcher, "Initia: The attack originated from a GCP key": https://www.chaincatcher.com/en/article/2303504
• Noble IBC packets from init1nyn989pkt2tx3rfz4rhzwldlh67vy4t30ccyz9 (Noble public LCD, fungible_token_packet sender query)
• Etherscan, 0x9926…5571 transfers and internal transactions; Circle CCTP: Message Transmitter V2; Uniswap V3: USDC 3; MetaMask: Swaps Spender
• Etherscan, multisend tx 0xd4583a90e5476eb6127cd44095db0f5a80dcf5f51f2ec5244f7adc57591385ef
• Injective docs, USDC CCTP domain ID 29: https://docs.injective.network/developers-defi/usdc-stablecoin
• BlockintAI, the first Initia exploit (October): https://blockint.ai/blog/initia-movevm-exploit-bridge-reserves