Initia, a community designed for interwoven optimistic rollups, has halted its layer 1 blockchain after it detected unauthorized transfers from escrow accounts holding belongings bridged to a number of rollups.
In response to the group, roughly $615,000 left the community earlier than the shutdown, with the incident elevating new issues for a undertaking that solely not too long ago restored operations after one other exploit that value it about $2.7 million.
Initia Identifies Compromised Rollup Infrastructure Keys
In a publish on X final night time, Initia stated it was “investigating a difficulty affecting rollup infrastructure” and that that they had been paused briefly.
“We now have not recognized any influence to person funds and we hope rollups will resume producing blocks quickly,” the group wrote at that stage.
Nonetheless, immediately, the story modified, with the group saying it had halted L1 operations at 06:18 UTC after preliminary investigations recognized unauthorized transactions from the community’s escrow accounts the place belongings bridged to numerous rollups had been being stored.
In response to them, the unauthorized transfers originated from compromised rollup infrastructure keys, which allowed an attacker to manufacture Inter-Blockchain Communication (IBC) transfers and make away with about $605,000 in USDC by way of Noble, together with one other $10,000 in different tokens, earlier than validators paused the community.
Nonetheless, they famous that a lot of the remaining belongings that had been moved out of the escrow accounts are nonetheless halted on the L1. The group additionally informed customers that they had been nonetheless making an attempt to ascertain the complete extent of the incident and would supply extra particulars as they turned accessible.
Second Assault In Much less Than a Month
This isn’t the primary time Initia has needed to take care of such an issue. Lower than three weeks in the past, an attacker took benefit of a vulnerability in its MoveVM script caching system to create unbacked WETH, iUSD, and USDC balances with out altering the corresponding token provides.
In that incident, the attacker managed to bridge roughly $2.7 million by way of LayerZero and Noble earlier than the community was shut down. Per Initia’s personal accounting, by October 24, the thief had managed to transform the stolen belongings into 1,135 ETH. The Initia Basis later accepted funding to revive the 1:1 backing of the affected belongings, overlaying as much as 1.08 million USDC, 105 ETH, and 1.4 million AUSD0.
Then on November 2, simply over per week earlier than the brand new exploit, the community resumed operations after making upgrades that included an independently audited MoveVM patch in addition to isolating the attacker’s remaining solid balances.
Again-to-back hits should not new in crypto. You could recall that in July, the Verus bridge misplaced $7.55 million to a hacker barely two months after thieves made off with $11.58 million, with safety agency Blockaid linking each assaults to the identical bridge contract and bug class.
Apparently, regardless of Initia’s L1 halt, CoinGecko knowledge on the time of writing confirmed its native INIT token up by nearly 60% in 24 hours and over 71% within the final seven days. It was additionally within the inexperienced throughout longer timeframes, having gained 45% within the final fortnight and nicely over 88% in 30 days, though it’s nonetheless 84% under its Could 2025 all-time excessive of $1.42.
The publish Initia Halts Blockchain After $615K Leaves Bridged Asset Escrows appeared first on CryptoPotato.