UPDATED 04:49 UTC, 11 Nov: In a fuller update posted on X at 16:43 UTC on 10 Nov, before this alert was published, Initia said about $3.27 million of assets were moved to the attacker’s Initia L1 address, and about $2.16 million of that is still on the paused L1, where it cannot be moved (Initia on X). The attacker sold some assets on the Initia DEX and withdrew 13,400 TIA, 8,000 USDC.inj and 597,000 Noble USDC before hitting Initia’s outbound IBC rate limits; no INIT left the chain, the team said. Initia says the breach began with a command-injection attack on 9 Nov that used a compromised Google Cloud key for provisioning private nodes. That exposed credentials to its GitHub and cloud accounts and then to Anvil, the hosting platform its rollups use, from which forged IBC withdrawals were validated on five rollups. Initia says it intends to restore the backing of affected assets in full and will publish the plan once it is confirmed, which supersedes the line below that it had not said whether users would be made whole. It is rebuilding the affected infrastructure from scratch and expects the restart to take longer than a routine one; it has given no timeline.
SECURITY ALERT
The chain came back on 2 Nov.
Eight days later, it stopped again.
Initia stopped its base chain, the layer 1, at 06:18 UTC on Tuesday together with its validators, after finding unauthorised transfers out of escrow accounts that hold assets bridged to several of its rollups, the team said in a post on X quoted by Protos.
Its preliminary review says about $605,000 in USDC left Initia through Noble, plus about $10,000 in other tokens, before the network stopped.
Most of the other assets moved out of the escrow accounts are still on the halted chain, Initia says.
The timeline
On Monday evening, Initia said it was investigating an issue affecting rollup infrastructure and had asked rollups to pause, crypto.news reported. At that point it said it had found no impact on user funds.
At 06:18 UTC on Tuesday, the L1 itself stopped producing blocks.
Rollups are separate chains that settle to Initia’s L1. Escrow accounts on the L1 hold the tokens that back assets moved onto them.
What emptied those accounts?
How it happened, so far
Initia’s answer: compromised rollup infrastructure keys, which let an attacker “fabricate IBC transfers”. IBC, the Inter-Blockchain Communication protocol, is how Cosmos-based chains pass tokens to one another. A forged IBC message can tell an escrow account to release funds that were never sent.
Initia has not said how the keys were compromised, who held them, or which rollups were affected.
The figures are not settled either.
Initia’s own preliminary figures add up to about $615,000. CertiK counted about $636,000 in suspicious outflows across 16 IBC transfers to Noble, crypto.news reported. Neither is a final loss figure.
No attacker has been named, and we do not name one.
How many keys does it take to secure a network of rollups?
The second time
This is Initia’s second halt in under three weeks. On 23 Oct, the 23 Oct halt over a minting bug followed a MoveVM flaw that let about $2.7 million leave for Ethereum. Initia patched it, said the backing of the affected tokens would be fully restored before the restart, and brought the chain and rollups back on 2 Nov.
This time it has given no restart date, and it has not said whether users will be made whole.
Will the backing be restored again?
Protect yourself
- Do not try to bridge into or out of Initia rollups until the team confirms the L1 and bridges are live.
- Treat any link, airdrop or “refund” message about Initia as suspect unless it comes from the project’s official accounts, as Initia itself warns.
- If you hold bridged USDC or other assets on an Initia rollup, keep a record of your balances and transactions now.
Corrections and new evidence: [email protected]
Related: Initia's layer 1 was still halted on 14 Nov, with no restart date announced
This article is for information only and is not investment advice.