Initia Halts Layer-1 After Attacker Drains $615K From Bridge Escrows

Initia halted its layer-1 blockchain at 06:18 UTC after an attacker extracted roughly $615,000 from escrow accounts holding assets bridged to rollups, the team said. The unauthorized transfers moved about $605,000 in USDC through Noble plus another $10,000 in other tokens before validators paused the network.

The attacker compromised rollup infrastructure keys, which let them fabricate Inter-Blockchain Communication (IBC) transfers and pull funds from the escrow accounts, according to Initia's disclosure. The team said most of the remaining assets moved out of escrow are still halted on the L1, limiting what the attacker can actually withdraw. Investigators have not yet established the full extent of the incident, and Initia said it will publish more details as they become available.

Earlier, the project had struck a calmer tone. "We have not identified any impact to user funds and we hope rollups will resume producing blocks soon," the team wrote before the second disclosure reversed that assessment.

What happened in the first attack?

The incident marks the second exploit of Initia's bridging infrastructure in under three weeks. On the earlier occasion, an attacker abused a vulnerability in Initia's MoveVM script caching system to mint unbacked WETH, iUSD and USDC balances without altering the corresponding token supplies.

The attacker bridged approximately $2.7 million through LayerZero and Noble before the network shut down. By October 24, per Initia's own accounting, the thief had converted the stolen assets into 1,135 ETH.

The Initia Foundation then approved funding to restore the 1:1 backing of the affected assets, covering up to 1.08 million USDC, 105 ETH and 1.4 million AUSD0. The network resumed operations on November 2 after shipping upgrades that included an independently audited MoveVM patch and the isolation of the attacker's remaining forged balances. The new exploit landed just over a week after that restart.

How does this fit wider bridge security patterns?

Back-to-back compromises of the same infrastructure are not unusual in crypto. In July, the Verus bridge lost $7.55 million to a hacker barely two months after thieves took $11.58 million from the same protocol. Security firm Blockaid linked both Verus incidents to the same bridge contract and bug class.

Initia's case follows a related pattern: the November 2 patch addressed the MoveVM flaw, but the new attack came through a different vector — compromised rollup infrastructure keys rather than a virtual-machine bug. That distinction matters operationally, because key management on rollup operators sits outside the scope of the audited MoveVM fix.

Did the halt hit the token?

Market data told an unusual story. Despite the L1 halt, CoinGecko showed the native INIT token up almost 60% in 24 hours and more than 71% over seven days at the time of writing. The token gained 45% over the fortnight and over 88% in 30 days, though it still traded 84% below its May 2025 all-time high of $1.42.

The rally alongside an active exploit underscores that INIT's price currently reflects factors other than network uptime.

Initia has not announced a timeline for resuming block production. The team said it will release further findings as its investigation into the compromised rollup keys and the full escrow outflows progresses.