Initia halts its L1 again after $605,000 leaves bridge escrows

Initia, the Cosmos-based blockchain that connects a network of rollups, halted its layer 1 chain at 06:18 UTC on 10 November in coordination with its validators. The team said it took the step after finding unauthorized transfers from the escrow accounts on the L1 that hold assets bridged to several rollups.

According to Initia, its investigation so far shows the transfers were made with compromised rollup infrastructure keys, which let a threat actor fabricate IBC transfers, the messages Cosmos chains use to move tokens between each other. Its preliminary review puts the loss at about $605,000 in USDC that left Initia through Noble, plus about $10,000 in other tokens, before the network stopped. Initia says most of the other assets moved out of the escrow accounts are still on the halted L1.

It is working with security teams, validators and exchanges to establish the full scope and has warned users about unofficial links, messages and claims.

The rollups were already paused

The halt follows a smaller notice the evening before. At 19:30 UTC on 9 November, Initia said it was investigating an issue affecting rollup infrastructure and had asked rollups to pause temporarily. At that point it said it had not identified any impact to user funds, and that the L1 remained live with some services, including the Initia Scan explorer, running slowly. Less than 12 hours later the L1 itself was stopped. Initia has not said whether the rollup issue and the escrow transfers are the same incident, how the keys were compromised, or which rollups were affected.

Second halt in 18 days

The chain had only been back online for eight days. On 23 October Initia halted the L1 and its rollups at 15:41 UTC after a different attack. In its account of that incident, the team said a threat actor exploited a bug in the script caching of Initia's MoveVM that let malicious code bypass security checks and credit itself with unbacked WETH, iUSD and USDC. Before the halt, roughly $2.7 million was bridged out: 105 WETH and about 1.4 million AUSD0 through LayerZero, and about 1.08 million USDC through Noble and CCTP, later swapped for 1,135.52 ETH.

Initia planned the restart around an independently audited MoveVM patch and isolating the threat actor's remaining forged balances, without rolling back transaction history, and the Initia Foundation covered the backing of the affected assets. The network came back on 2 November, with 24-hour withdrawal times for WETH and AUSD0 and an hourly rate limit on Noble USDC withdrawals. The team said then that a full post-mortem would follow that week.

The two incidents hit different parts of the system. October's was a flaw in the chain's virtual machine; this one, by Initia's account so far, came from keys that operate rollup infrastructure. In both cases USDC left through Noble before the chain could be stopped.

What is not known yet

Initia has not given a restart date, said whether user balances on the rollups are affected, or said whether the Foundation will again restore the backing of the drained assets. It has not published the address that received the USDC. The team says it will share more details as they become available.