Initia halts layer-1 chain again after $615K escrow exploit

What happened

Initia halted its layer-1 blockchain at 06:18 UTC on November 10 after detecting unauthorized transfers from escrow accounts that hold assets bridged between its main chain and connected rollups. The team said it coordinated with validators to stop block production and prevent further movement of funds.

According to Initia's preliminary investigation, attackers gained access to compromised rollup infrastructure keys and used them to fabricate Inter-Blockchain Communication (IBC) transfers. That mechanism normally lets connected chains exchange data and move assets through established channels; in this case, the team said transfers were created without proper authorization.

Initia estimated roughly $615,000 in unauthorized transfers. Before the halt, about $605,000 in USDC and another $10,000 in other tokens had left the network through Noble, the team said. Most of the remaining assets moved from the affected escrow accounts were reported to still be on the halted chain.

Blockchain security firm CertiK reported detecting approximately $636,000 in suspicious outflows across 16 successful IBC transfers from an Initia address to Noble, a higher figure than the project's own preliminary estimate. Neither number has been described as final, and Initia said it is working with security specialists, validators and exchanges to establish the full scope.

Why it matters

The incident is the second security-related shutdown for Initia in less than three weeks, a pattern that puts attention on the resilience of rollup infrastructure and the escrow arrangements that hold bridged assets. Because the affected accounts held funds tied to several rollups in the ecosystem, the fallout could extend beyond the main chain to projects that depend on it.

The episode also highlights a recurring problem in cross-chain design: keys that authorize transfers between chains are high-value targets, and a single compromise can let an attacker mint the appearance of legitimate traffic. Initia has not said how the credentials were obtained, which leaves open questions about operational security around the rollup infrastructure.

What the data shows

CoinGecko data cited in the reports showed INIT trading near $0.2057, up 61.31% over 24 hours, with trading volume of about $84.81 million and a market capitalization near $46.37 million. Circulating supply was reported at approximately 220 million tokens, and the token had gained 54.22% over the prior seven days. CryptoPotato noted INIT remained well below its May 2025 all-time high of $1.42.

Background

Initia's previous halt came on October 23 after unauthorized token creation. In an October 24 statement, the team said an attacker exploited a vulnerability in its MoveVM script-caching system, allowing malicious code to bypass security checks and credit unbacked WETH, iUSD and USDC balances. About $2.7 million was bridged out before validators stopped the network, including 105 WETH, roughly 1.4 million AUSD0 and about 1.08 million USDC, later swapped for 1,135.52 ETH on Ethereum. Initia said no native INIT was minted in that attack.

The project resumed operations on November 2 after security work and a MoveVM patch. On November 9, it disclosed another issue affecting rollup infrastructure and said it had coordinated temporary rollup pauses while the main chain stayed online, stating at that stage that it had not identified any impact to user funds. The following investigation surfaced the unauthorized escrow transfers and led to the November 10 shutdown.

What is still unclear

Initia has not explained how the rollup infrastructure keys were compromised or who controlled them before the incident. The announcement did not identify the affected rollups or say whether the infrastructure was run by Initia or by separate parties. It is also unclear how much of the transferred funds can be recovered, whether the November incident is linked to the October attacker, and when block production will resume. No reimbursement plan for affected users has been announced.

What to watch

The next signals to watch are Initia's full post-mortem, any resumption of block production, and whether exchanges or bridge partners take additional precautions with assets tied to the affected escrow accounts. The gap between the project's $615,000 estimate and CertiK's $636,000 figure may also be resolved as the investigation proceeds.

Questions readers ask