-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0333
============================================================

Advisory-ID:  0xCERT-2026-0333
Severity:     Medium
Published:    2026-11-10T06:18:00.000Z
Updated:      2026-11-10T12:44:14.867Z
Chains:       Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0333

Title: Initia L1 halted again after compromised rollup keys forged IBC transfers draining about $615K from escrow

Summary
- -------
Initia halted its L1 at 06:18 UTC on 10 November 2026 after unauthorized transfers from escrow accounts holding assets bridged to several rollups; about $605K USDC left via Noble plus about $10K in other tokens. Ignore unofficial links and 'recovery' offers and follow Initia's official channels.

Details
- -------
Summary
Initia states that the Initia L1 was halted at 06:18 UTC on 10 November 2026, in coordination with validators, after it identified unauthorized transfers from escrow accounts on the L1 that hold assets bridged to several rollups. Initia's preliminary finding is that compromised rollup infrastructure keys were used to fabricate IBC transfers. This is Initia's second L1 halt in under three weeks; the 23 October incident (0xCERT-2026-0267) had a different root cause.

Affected
- - Initia L1 escrow accounts holding assets bridged to several Initia rollups
- - No fix available at time of publication; the L1 remains halted with no announced restart timeline

Impact
About $605,000 in USDC left via Noble, plus about $10,000 in other tokens (Initia, as recorded by SlowMist); most remaining assets stayed on the halted L1. CertiK reported about $636,000 in suspicious outflows across 16 successful IBC transfers from an Initia address to Noble; the sources' loss figures differ and the final amount is not yet established. Initia has not said how the rollup keys were obtained. Exploitation is confirmed. No attacker addresses have been published by the primary sources, so no indicators are listed.

Recommended actions
- - Do not interact with Initia bridges or rollup bridging until Initia announces the chain has resumed safely.
- - Ignore unofficial links, DMs and "recovery" offers; Initia warned users about these. Follow only Initia's official channels.
- - Rollup operators on Initia should review and rotate infrastructure keys per Initia's guidance.

Source & attribution
This 0xCERT advisory summarises Initia's disclosure (https://x.com/initia/status/2120050740626628972), corroborated by SlowMist's incident record (https://hacked.slowmist.io/) and CertiK's alert (https://x.com/CertiKAlert/status/2120101370909151548) as reported by crypto.news (https://crypto.news/initia-blockchain-halt-615k-exploit-init-price/). Details may change; refer to the original sources for the authoritative record.

References
- ----------
- - https://x.com/initia/status/2120050740626628972
- - https://hacked.slowmist.io/
- - https://x.com/CertiKAlert/status/2120101370909151548
- - https://crypto.news/initia-blockchain-halt-615k-exploit-init-price/
- - https://www.0xcert.com/advisory/0xCERT-2026-0267

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrzmIQJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdIxVvRtjhuzZxAfm98cBumTcTvt8dsU3mYfzC4
bJzpIBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABnUgD/UuNZuCP90L+iqylZ
GRw2vyYW1LyvBpXThJi6blgEAt8BAJ45gHk9hFvn2SQ4H+EzrQPniaCA45hv
bSIsQfUwwzYK
=AAze
-----END PGP SIGNATURE-----