Initia Cloud Key Breach Drains $3.27 Million as Arcus Fixes Bug

Initia has been hit by its second exploit in three weeks. A compromised Google Cloud key let an attacker approve forged withdrawals from five rollups. About $3.27 million moved. The figure has not been confirmed in a readable project statement.

• Initia: about $3.27 million moved after a compromised Google Cloud key, the second exploit in three weeks.
• Arcus: Arcus Labs said it fixed an accounting bug within one hour and covered the shortfall from its treasury; $3 million of requested withdrawals was held by the bridge's on-chain rate limit.
• XRPL: the XRP Ledger will reset Testnet and Devnet on 25 November 2026, deleting all test ledger data while Mainnet continues.

Initia's Second Breach in Three Weeks

The first exploit came on 23 October. An attacker used a bug in the script cache of MoveVM, the virtual machine that runs Initia's smart contracts. About $2.7 million flowed out, according to two independent reports.

The second used a different route. A compromised Google Cloud key allowed forged withdrawals from five rollups, which are separate chains that settle on Initia. About $3.27 million moved.

Initia's own X statement was not readable. The $3.27 million figure and the five-rollup detail rest on three independent reports. The project has not published a readable incident report.

Arcus Says Bug Fixed Within an Hour

Arcus Labs said in its incident report: “We detected and fixed the bug within one hour and have covered the full shortfall. No user balances were affected and trading and withdrawals are operating normally.”

The report puts the exploit at 9 November at around 10:07 PM ET. Some coverage described it as early on 10 November. The primary record uses the 9th.

A further $3 million of requested withdrawals was held by the bridge's on-chain rate limit. It was never paid out and was later reversed, the report says.

XRPL Will Wipe Testnet and Devnet on 25 November

The XRP Ledger will reset its Testnet and Devnet on Wednesday, 25 November 2026. Testnet and Devnet are development networks where builders try code before it reaches Mainnet, the live XRP Ledger.

The reset will delete all ledger data in those networks, including accounts, transactions, balances, settings, offers, AMMs and escrows. An AMM is an automated market maker, a contract that holds tokens and prices trades by a formula.

The XRPL blog said: “Testnet relied on a single full history server, which crashed and can't be recovered without a reset.” Mainnet continues to operate as usual.

What to Watch

The next dated event is the XRPL reset on 25 November. For Initia, the missing piece is a readable incident report. It would confirm the $3.27 million figure and the five rollups. Until then, the second exploit is reported by three independent outlets but not confirmed by the project's own page.