Initia stopped its layer 1 blockchain on Tuesday after an attacker used compromised rollup infrastructure keys to fake cross-chain transfers and pull assets out of the escrow accounts that back tokens bridged to its rollups. About $605,000 in USDC left through Noble before the halt, the team said. It is the second time in less than three weeks that the Initia L1 has been frozen after a security incident, and it lands while the INIT token is under a formal caution review at Upbit.
What Initia has disclosed
The L1 “was halted at 06:18 UTC on November 10 in coordination with validators as a protective measure,” Initia said about 50 minutes later. The team said it found unauthorized transfers from escrow accounts on the L1 that hold assets bridged to several rollups, and that its investigation so far points to “compromised rollup infrastructure keys allowing an attacker to fabricate IBC transfers.” IBC is the messaging standard Cosmos-based chains use to move tokens between each other.
Initia’s preliminary count is about $605,000 in USDC that left through Noble, the Cosmos chain that issues native USDC, plus roughly $10,000 in other tokens. It said most of the other assets moved out of the escrow accounts are still sitting on the halted L1. The team is working with security firms, validators and exchanges to establish the full scope and has not yet named the affected rollups or given a restart date.
The chain’s public RPC endpoint confirms the stop. As of 10:10 UTC its latest block was 23,680,323, timestamped 06:18:40 UTC.
The halt followed a separate notice on Monday evening, when Initia said it was investigating “an issue affecting rollup infrastructure,” had asked rollups to pause temporarily and had “not identified any impact to user funds.” Initia has not said whether that issue and Tuesday’s transfers are connected.
Second freeze in 18 days
On Oct. 23, a bug in Initia’s MoveVM let an attacker credit themselves with unbacked tokens and bridge out about $2.7 million before the network was stopped. The L1 and its rollups only came back online on Nov. 2, with backing for the affected assets restored and new limits on bridge withdrawals, as we reported at the restart.
The two incidents work differently. October’s was a flaw in the virtual machine. Tuesday’s, by Initia’s account so far, came from compromised keys on the rollup side, which let the attacker make the L1 accept transfers that never really happened on the rollups. Both ended the same way, with value leaving Initia over its bridges before the chain could be stopped. Bridge withdrawals that should never have been honored also emptied the Ankr bridge on Monday, though there is no sign the two incidents are linked.
Upbit’s review now has a second incident
Upbit suspended INIT withdrawals on Tuesday, citing the stop in block production, while leaving trading open. INIT deposits were already off at Upbit. The exchange designated INIT a caution token on Oct. 26 over the October hack, with a review period running to the week of Nov. 23 to 27. Upbit said at the time that the designation can be extended, lifted or end in a delisting if the reasons behind it are not fully resolved. The reason Upbit gave for the designation was a hacking or other security incident whose cause had not been identified or fixed.
INIT’s rally came before the halt
INIT is up about 74% over 24 hours on Binance, which has drawn comments about a token rising through a hack. The hourly data tells a more specific story. INIT climbed from about $0.13 on Monday afternoon to near $0.20 by 21:00 UTC and was trading at about $0.223 in the minute the chain stopped. Since the halt it has moved between roughly $0.209 and $0.237 and was back near $0.223 at 10:10 UTC. In other words, the whole daily gain was in place before the halt and the escrow drain were disclosed, and Initia has not commented on the price.
The Korean won market is out of line with offshore prices. On Bithumb, INIT last traded at 275 won, about $0.20, roughly 9% below Binance, on about 15.2 billion won ($11.3 million) of 24-hour volume. With the network not producing blocks, INIT cannot be moved on its own chain, which leaves little room to close a gap like that.
What to watch next: Initia’s full count of what left the escrow accounts, which rollups were involved and how their keys were compromised, whether the foundation again covers any shortfall, and how Upbit treats the second incident when its review ends.
FAQ
Why did Initia halt its L1?
Initia said it halted the chain at 06:18 UTC on Nov. 10 after finding unauthorized transfers from escrow accounts that back assets bridged to its rollups, made with compromised rollup infrastructure keys.
How much was taken?
Initia’s preliminary figure is about $605,000 in USDC that left through Noble, plus about $10,000 in other tokens. It said most other assets moved out of escrow are still on the halted L1.
Is this the same bug as October’s Initia exploit?
No, based on what Initia has said so far. October’s $2.7 million loss came from a MoveVM bug, while this incident involved compromised rollup keys used to fake IBC transfers.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
