Initia halts L1 again after compromised rollup keys drain ~$615K in escrow USDC

Initia paused its Layer 1 at 06:18 UTC on November 10 after an attacker used compromised rollup infrastructure keys to forge Inter-Blockchain Communication (IBC) transfers out of its escrow accounts. About 605,000 USDC moved through Noble before the halt, along with roughly $10,000 in other tokens — a ~$615K drain. The chain had restarted only on November 2 after an earlier $2.7M MoveVM exploit on October 23, so cumulative losses across three weeks sit near $3.3 million, now above the chain's own TVL. Primary source is Initia's statement on X, relayed by Cryptoast, Protos and Phemex.

What happened

Initia's own statement on X: "The Initia L1 was halted at 06:18 UTC on November 10 in coordination with validators as a protective measure." The team's preliminary read, cited by multiple outlets:

• The attacker controlled keys tied to rollup infrastructure (not the L1 validator set).
• Those keys were used to forge IBC transfers from Initia escrow accounts to a receiving address on Noble.
• 16 successful IBC transfers were counted by CertiK, totalling approximately $636,000 in suspicious outflow — of which ~605,000 USDC reached the attacker-controlled destination. One disclosure cited by coverage goes as high as ~$3.27M; the final number is unsettled pending a post-mortem.
• Initia says most of the assets that remain in escrow are still on the halted L1 and may be recoverable via validator coordination.

Neither an attacker address nor a drain tx has been published by Initia yet, and the exact scope of the compromise — which rollup, which signer, how long the keys were exposed — has not been disclosed.

The mechanism: forged IBC via a rollup signer, not an L1 bug

The October hack and the November hack are not the same bug. The October 23 exploit abused the MoveVM script-caching path and let the attacker mint unbacked WETH, iUSD and USDC on Initia itself, with proceeds bridged out to Ethereum via LayerZero and Noble and converted into 1,135 ETH. The November incident is operational: compromised keys that controlled rollup infrastructure were used to sign IBC transfers the protocol accepted as valid. In both cases the funds exited via Noble, which has become the common cash-out route for IBC-routed thefts.

The relevant primitive to patch is key custody — HSM rotation, m-of-n signing, continuous attestation — not the IBC protocol itself. IBC did what it was told; the signer was wrong.

Numbers block

• Initia TVL (DefiLlama): $3.2M — down more than 92% from its May 2025 peak of **$42M**.
• Cumulative losses, Oct 23 + Nov 10: ~$3.3M.
• Stolen in second incident: ~605,000 USDC via 16 forged IBC transfers (CertiK); ~$10K in other tokens.
• INIT price action during the incident: up ~80–110% over 24 hours (reported by multiple outlets; drivers debated, with some users calling it a "crime pump").
• Backers of record: YZi Labs (formerly Binance Labs, 2023), Delphi Ventures and HackVC (2024).

Price action is reported here as context for the incident, not as a view on where INIT trades next. The halt condition on the L1 is the fact that matters for anyone holding INIT off-chain.

Impact

With TVL now below cumulative losses, Initia faces the harder second-incident problem: user confidence, validator coordination on asset recovery, and a post-mortem that has to explain both a VM-level bug and a key-custody failure within three weeks. Most funds still in escrow are stuck on the halted L1; exchange operations are frozen while Initia coordinates with validators, security partners and exchanges.

No restart time has been announced.

Context

The pattern here — a cross-chain protocol compromised twice in short succession, with the second incident targeting operator keys rather than protocol code — echoes the Nomad, Multichain and Ronin sequences from earlier cycles, where the initial exploit was a code bug and the follow-on compromise was operational. For Initia specifically, the move from MoveVM caching to rollup-signer compromise means the recovery plan has to cover two independent failure modes. The practical bar for a restart is now the one validators and the team set themselves: a public rotation of every rollup signer, a published post-mortem for both incidents, and a restart block that can be verified independently.

What to watch

1. Attacker address and the Noble cash-out route. Initia has not posted them yet. Once published, the destination addresses on Noble will say whether the funds have moved on to another chain.
2. Which rollup signers were compromised, and how. The scope answer determines whether this is a single-signer incident or a wider key-management failure across multiple rollups.
3. Validator-coordinated recovery of the remaining escrow. "Most of the assets remain on the halted L1" is the key claim. If validators coordinate an upgrade that returns those funds to their original owners, the post-mortem will be a different story than if they cannot.
4. Restart conditions. A hard commitment to a public signer-rotation plus a dual post-mortem is a reasonable minimum before unhalting.