Initia Halts Rollups After 605,000 USDC Leaves Multi-Rollup Asset Account

Initia coordinated a halt of its layer-1 network and affected rollups at 1:18 a.m. ET on Nov. 10 (06:18 UTC) after detecting unauthorized transfers from a mainnet account that held assets for multiple rollups, according to the protocol team's incident statement. Roughly 605,000 USDC, plus other tokens valued at about $10,000, left the account before validators stopped block production.

Initia said it has found no evidence so far that user funds were affected. That is a preliminary claim, and the team has not yet said how the keys were compromised. The investigation continues with external security teams, validators and exchanges.

What happened on-chain?

The transfers moved assets through Noble, a Cosmos-based issuance chain, from the mainnet account that pooled assets used across multiple rollups. Most of the non-USDC assets moved from the account stayed on the paused layer-1 network rather than reaching an external destination, which limits immediate recoverability questions but does not close them.

To put the figure in context: 605,000 USDC is roughly the annual median household income in several major U.S. metro areas. The additional $10,000 in other tokens is small by comparison, though token valuations on a paused network are inherently uncertain.

What was the suspected attack vector?

Initia's preliminary investigation points to two linked causes: a compromise of keys tied to rollup infrastructure, and forged Inter-Blockchain Communication (IBC) transactions used to move the assets out. IBC is the Cosmos ecosystem's standard for transferring assets between sovereign chains; forging valid IBC messages typically requires control of signing keys rather than a flaw in the protocol itself.

The team has not disclosed which keys were taken, how many rollups were affected, or whether the compromised infrastructure was operated by Initia or by a third party. Those gaps matter. Until key custody responsibilities are clarified, the operational cause remains an assumption rather than a verified finding.

Initia Scan, the network's explorer and analytics service, also suffered performance problems during the incident, according to the team's statement.

What happens next?

Initia says it is working to restore block production at affected rollups as soon as possible. It has not given a target time, and no restart deadline has been published.

Three operational workstreams are underway:

• Assessing the full scope of the incident with security teams, validators and exchanges
• Restoring block production at affected rollups
• Recovering or accounting for the transferred assets, most of which remain on the paused network

The pause itself is a defensive measure, not a resolution. A halted network prevents further transfers, but it also freezes legitimate activity across every rollup that depended on the shared asset account. The longer production stays down, the greater the disruption to applications built on those rollups.

In short: a suspected key compromise moved about $615,000 in assets, the network is paused, and the recovery timeline is undefined.

The next verifiable milestone will be the resumption of block production and a post-incident report identifying the compromised keys. Until both arrive, the claim that user funds are safe rests on the team's own preliminary review.