Initia Halts L1 Chain After $615K Escrow Drain
Key Summary
Initia suspended its layer 1 blockchain operations Tuesday morning following the unauthorized extraction of $615K in bridged assets from network escrow accounts. Compromised rollup infrastructure keys enabled the attacker to execute fraudulent IBC transfers just weeks after a separate $2.7M exploit temporarily shut down the same network.
Key Bullets
- Initia developers halted the layer 1 blockchain at 06:18 UTC after detecting unauthorized transfers originating from compromised rollup infrastructure keys.
- The attacker drained 605,000 USDC through Noble alongside 10,000 tokens in other assets before network validators successfully paused operations.
- This security breach marks the second major incident for the network in less than three weeks following a previous $2.7M exploit.
- CoinGecko exchange data recorded the native INIT token trading up by 60% over a 24-hour period despite the emergency network shutdown.
Emergency Shutdown Follows Escrow Key Compromise
Initia halted its layer 1 blockchain Tuesday morning at 06:18 UTC after detecting unauthorized transfers leaving network escrow accounts. According to incident disclosures published by the core development team, an attacker compromised rollup infrastructure keys to fabricate Inter-Blockchain Communication transfers. The malicious transactions drained 605,000 USDC through Noble alongside 10,000 tokens in miscellaneous assets before validators intervened to freeze network activity. Most remaining assets extracted from the escrow contracts remain frozen on the base layer while developers audit the state of the chain.
The team had initially claimed via social media broadcasts that rollup infrastructure was simply paused without immediate risk to user deposits. That narrative shifted once on-chain telemetry confirmed actual outflows from the bridged asset pools. Investigators are currently mapping the exact vector used to compromise the infrastructure keys.
Second Multi-Million Exploit Strikes Network Within Weeks
This security failure follows a separate $2.7M exploit that forced Initia to halt operations less than three weeks prior. In that previous attack, an adversary exploited a MoveVM script caching vulnerability to mint unbacked WETH, iUSD, and USDC balances without altering total token supplies. The attacker bridged those forged tokens through LayerZero and Noble, converting the proceeds into 1,135 ETH by October 24. The Initia Foundation subsequently approved treasury funding to restore 1:1 backing for affected users, covering 1.08M USDC, 105 ETH, and 1,400,000 AUSD0.
The network resumed block production on November 2 after deploying an independently audited MoveVM patch and isolating the remaining forged balances. The latest escrow drain bypassed those recent security upgrades entirely by targeting external infrastructure keys rather than the script caching engine.
Token Price Diverges From Operational Halt
Market participants traded the native INIT token higher despite the layer 1 suspension. CoinGecko order-book data tracked the asset rising by 60% over a 24-hour window and 71% across the trailing seven days. Long-term charts place the token 84% below its May 2025 ATH of $1.42.
Traders ignored the network halt entirely.
MoveVM Script Vulnerabilities and Prior Network Halts
Today's development follows an established trajectory that began on Oct 24, 2026, when an emergency shutdown hit the Initia blockchain after a malicious actor manipulated native minting functions to create $2.7M in unbacked tokens. During that earlier incident, validation nodes halted block production instantly to prevent widespread asset dumping across decentralized secondary markets. Ethereum records subsequently showed 1.4 million AUSD leaving a bridge adapter, although issuer Agora confirmed no smart contracts were deployed natively on the network at the time, leaving developers facing complex state rollback challenges.
Impact score:4 out of 5 | Narrative Tracker:Security, Exploits & Asset Recovery
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.