If assets you hold sit in a protocol’s cross-chain custody account, a leaked infrastructure key can move them without your own wallet signing anything. That is the holding question raised by an Initia incident that 深潮 TechFlow reported on November 10, 2026—not a new development after that date.
Initia said that at 06:18 UTC on November 10, after unauthorized transfers were found from multiple Rollup cross-chain asset custody accounts on the L1 mainnet, the project coordinated with validators to pause L1 operations. The stated purpose of the pause was to prevent further losses.
A preliminary investigation, as relayed in that report, suggests the attacker used leaked Rollup infrastructure keys to forge IBC cross-chain transfers. Initia framed this as a suspicion from the early inquiry, not as a finished public conclusion.
Before the pause, about 605,000 USDC left Initia through Noble, and about $10,000 of other tokens also moved out. The report put the combined outflow at about $615,000. Those figures are approximate. Initia said most of the remaining assets transferred out of the custody accounts were still on the paused L1.
The trade-off is between stopping further movement and keeping funds reachable. A pause can limit additional unauthorized transfers, but assets that remain on the halted L1 are not accessible while the network stays stopped. Assets that had already left through Noble are outside that pause. TechFlow’s account does not describe a completed recovery, a final confirmed loss, or a user remediation plan.
The reported failure sits at a custody trust boundary, not at an individual holder’s signature. Confidentiality of the Rollup infrastructure keys is what the preliminary account says was broken; accessibility of the remaining funds depends on the paused L1. The report does not describe a redundant control that would have blocked a forged IBC transfer after those keys were exposed, and it does not claim any custody setup removes this risk.
What the report actually supports checking is limited: the L1 was paused after the unauthorized transfers, the outflow amounts above are preliminary estimates, most remaining assets moved from the custody accounts were said to still be on that paused network, and Initia said it was working with security firms, validators, and exchanges on the scope and would publish more later.
Original report, published November 10, 2026, 15:44 (UTC+8): 深潮 TechFlow.
