Initia has halted its layer 1 blockchain after detecting unauthorized transfers from escrow accounts that held assets bridged to several rollups. The network said about $615,000 left before validators stopped the chain.

According to the incident description, compromised rollup infrastructure keys allowed an attacker to fabricate Inter-Blockchain Communication transfers. That let funds be released from escrow, including roughly $605,000 in USDC routed through Noble and about $10,000 in other tokens.

How the incident unfolded

The shutdown took place after Initia identified suspicious movements from escrows that back bridged assets on connected rollups. Those escrows sit on the layer 1 and are meant to hold the underlying assets while corresponding balances circulate elsewhere in the network.

Initia said the attacker did not need to drain every escrow before the response. Validators paused the chain after the fabricated transfers were detected, limiting further movement. The team added that most of the remaining assets involved were still halted on the layer 1 when operations were stopped.

Compromised keys and fabricated IBC transfers

The immediate cause described by Initia was a compromise of rollup infrastructure keys. With those keys, the attacker was able to create fake IBC transfer activity that appeared sufficient to trigger releases from escrow accounts.

The largest identified movement was about $605,000 in USDC sent through Noble. Initia also reported another roughly $10,000 in other tokens leaving the system before the halt. The project said it is still assessing the full scope of the incident, so the final accounting may change as that review continues.

Second major exploit in less than a month

The latest disruption follows another breach less than a month earlier that had a far larger impact. In that case, a vulnerability in MoveVM scripting created unbacked token balances, which the attacker then bridged out through LayerZero and Noble.

Initia said that earlier exploit led to about $2.7 million being moved before the network was shut down. Afterward, the Foundation funded the restoration of backing for affected assets, and the chain later resumed operations following upgrades.

What happened after the earlier breach

The post-incident changes after the previous exploit included a MoveVM patch and the isolation of forged balances. Those steps were presented as part of the process to restart the network after the earlier losses.

For the current event, the confirmed next step is a continuing investigation into the total damage and the condition of escrowed assets. Initia has not yet provided a final loss figure beyond the roughly $615,000 identified before the shutdown.

Source: cryptopotato.com