Most assets moved from Initia’s escrow accounts remained on the halted L1, leaving their status tied to the network’s recovery process.
Initia, a network designed for interwoven optimistic rollups, has halted its layer 1 blockchain after it detected unauthorized transfers from escrow accounts holding assets bridged to several rollups.
According to the team, approximately $615,000 left the network before the shutdown, with the incident raising new concerns for a project that only recently restored operations after another exploit that cost it about $2.7 million.
Initia Identifies Compromised Rollup Infrastructure Keys
In a post on X last night, Initia said it was “investigating an issue affecting rollup infrastructure” and that they had been paused temporarily.
“We have not identified any impact to user funds and we hope rollups will resume producing blocks soon,” the team wrote at that stage.
However, today, the story changed, with the team saying it had halted L1 operations at 06:18 UTC after preliminary investigations identified unauthorized transactions from the network’s escrow accounts where assets bridged to a number of rollups were being kept.
According to them, the unauthorized transfers originated from compromised rollup infrastructure keys, which allowed an attacker to fabricate Inter-Blockchain Communication (IBC) transfers and make away with about $605,000 in USDC through Noble, along with another $10,000 in other tokens, before validators paused the network.
However, they noted that most of the remaining assets that had been moved out of the escrow accounts are still halted on the L1. The team also told users that they were still trying to establish the full extent of the incident and would provide more details as they became available.
Second Attack In Less Than a Month
This is not the first time Initia has had to deal with such a problem. Less than three weeks ago, an attacker took advantage of a vulnerability in its MoveVM script caching system to create unbacked WETH, iUSD, and USDC balances without changing the corresponding token supplies.
You may also like:
In that incident, the attacker managed to bridge approximately $2.7 million through LayerZero and Noble before the network was shut down. Per Initia’s own accounting, by October 24, the thief had managed to convert the stolen assets into 1,135 ETH. The Initia Foundation later approved funding to restore the 1:1 backing of the affected assets, covering up to 1.08 million USDC, 105 ETH, and 1.4 million AUSD0.
Then on November 2, just over a week before the new exploit, the network resumed operations after making upgrades that included an independently audited MoveVM patch as well as isolating the attacker’s remaining forged balances.
Back-to-back hits are not new in crypto. You may recall that in July, the Verus bridge lost $7.55 million to a hacker barely two months after thieves made off with $11.58 million, with security firm Blockaid linking both attacks to the same bridge contract and bug class.
Interestingly, despite Initia’s L1 halt, CoinGecko data at the time of writing showed its native INIT token up by almost 60% in 24 hours and over 71% in the last seven days. It was also in the green across longer timeframes, having gained 45% in the last fortnight and well over 88% in 30 days, although it is still 84% below its May 2025 all-time high of $1.42.
