---
title: Initia halts its L1 again after an attacker used compromised rollup infrastructure keys to fake IBC transfers out of bridge escrow, moving about $615K off-chain | ctxsec
url: https://ctxsec.com/items/initia-l1-halted-compromised-rollup-keys-fake-ibc-transfers-605k-usdc-nov-10
description: "Initia says it halted the L1 at 06:18 UTC on Nov 10 with its validators after finding unauthorized transfers from the L1 escrow accounts that hold assets bridged to several rollups. Its early read is that compromised rollup infrastructure keys let the attacker fabricate IBC transfers. About $605,000 in USDC left through Noble plus about $10,000 in other tokens; most of the rest is still on the halted chain. On Nov 9 Initia had paused rollups over a rollup infrastructure issue and said it saw no impact to user funds."
status: "official (Initia on X, Nov 10, 2026 07:07 UTC); preliminary figures from Initia; full scope still under investigation"
published: 2026-11-10
---

> Initia says it halted the L1 at 06:18 UTC on Nov 10 with its validators after finding unauthorized transfers from the L1 escrow accounts that hold assets bridged to several rollups. Its early read is that compromised rollup infrastructure keys let the attacker fabricate IBC transfers. About $605,000 in USDC left through Noble plus about $10,000 in other tokens; most of the rest is still on the halted chain. On Nov 9 Initia had paused rollups over a rollup infrastructure issue and said it saw no impact to user funds.

[← Cybersecurity News](/news) · [markdown](/items/initia-l1-halted-compromised-rollup-keys-fake-ibc-transfers-605k-usdc-nov-10.md)

official (Initia on X, Nov 10, 2026 07:07 UTC); preliminary figures from Initia; full scope still under investigation

2026-11-10

### Initia halts its L1 again after an attacker used compromised rollup infrastructure keys to fake IBC transfers out of bridge escrow, moving about $615K off-chain

- This is Initia's second halt in under three weeks, after the Oct 23 MoveVM mint exploit (about $2.7M).
- The lesson for bridge and rollup operators: escrow on the hub trusts whatever the rollup's keys sign, so those keys need the same HSM, quorum and monitoring treatment as the escrow itself.
- Initia warns users to ignore unofficial links and "refund" messages.

Sources: [Initia on X: L1 halt statement (Nov 10, 2026)](https://x.com/initia/status/2120050740626628972) · [Initia on X: rollup infrastructure issue (Nov 9, 2026)](https://x.com/initia/status/2119875372183703612)