Assets that sit in a protocol’s cross-chain custody accounts depend on infrastructure keys the holder does not control. That distinction was at the center of an incident Initia described on November 10, 2026.
TechFlow reported that day that Initia said it discovered unauthorized transfers from multiple Rollup cross-chain asset custody accounts on the L1 mainnet at 06:18 UTC. The project coordinated with validators to pause the L1 network in order to limit further losses.
A preliminary investigation, as relayed by Initia, indicated that an attacker was suspected of using leaked Rollup infrastructure keys to forge IBC cross-chain transfers. Before the pause, about 605,000 USDC left Initia through Noble, and roughly $10,000 in other tokens also moved out, for an approximate total of $615,000. Initia said most of the remaining assets transferred from those custody accounts were still on the paused L1 network.
The team said it was working with security agencies, validators, and exchanges to determine the scope of the incident and would publish more information later.
Pausing the chain can stop additional unauthorized movement, but it also suspends ordinary transfers until the network resumes. The figures above are approximate, the findings were described as preliminary, and the reported issue concerned Rollup infrastructure keys for custody accounts rather than a completed accounting of every affected balance.