Initia suspended its Layer 1 blockchain and associated rollups after a security exploit reportedly enabled unauthorized token minting and the movement of millions of dollars in digital assets to Ethereum.
The network halt took effect at 3:41:30 p.m. UTC on October 23, according to Initia’s announcement. The team said it was working with security researchers, validators, and cryptocurrency exchanges to investigate the incident and assess its impact.
The exploit reportedly involved the unauthorized creation of 2 million AUSD tokens, followed by cross-chain transfers that moved stablecoins and Ether to Ethereum before the network was suspended. Initia had not confirmed the total financial losses or disclosed a definitive explanation of the vulnerability at the time of reporting.
Attackers Reportedly Move Millions to Ethereum
Blockchain security researcher Spreek initially flagged the incident, reporting that an attacker had minted tokens without authorization and converted approximately $2.6 million in assets. Additional funds were reportedly being moved as the investigation developed.
Decentralized finance platform D2 Finance subsequently provided further details about the suspected attack. According to its account, the attacker exploited a vulnerability to create 2 million AUSD tokens without sufficient backing and then used cross-chain transfers to move approximately 1.4 million AUSD, 105 Ether (ETH), and 1.08 million USD Coin (USDC) to Ethereum.
The transferred assets were reportedly consolidated into an Ethereum wallet holding approximately 1,135.5 ETH, valued at about $2.73 million. Blockchain transaction records also indicated that stablecoins were exchanged before the resulting Ether was transferred.
The reported figures represent estimates from external observers rather than a final loss assessment from Initia. The precise amount affected and the complete sequence of transactions remained subject to investigation.
Dispute Emerges Over AUSD Minting Claims
Agora, the issuer associated with AUSD, disputed the account linking the token’s unauthorized minting directly to its infrastructure on Initia. The company said it did not have smart contracts deployed on the network, raising questions about how the reported token creation occurred and which components were involved.
Agora also outlined limits on its ability to freeze assets. It said its response would focus on relevant hacker addresses holding AUSD on blockchains where its own smart contracts were deployed.
The distinction is significant because freezing tokens through an issuer-controlled contract is different from stopping transactions on another blockchain or recovering assets that have already been transferred. The effectiveness of any intervention would depend on the contracts and networks involved.
Preliminary Findings Point to a MoveVM Vulnerability
Preliminary findings attributed to Initia co-founder Ezaan Mangalji, also known as Zon, reportedly pointed to a previously unknown vulnerability in the network’s MoveVM implementation operating with the Cosmos SDK.
The suspected flaw was described as a zero-day vulnerability, meaning it was not previously known or addressed when it was exploited. The preliminary account indicated that the issue could allow unauthorized token minting.
As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident.
Our team is actively investigating the situation and working to establish the full scope of any impact with security teams, validators, and exchanges.
We will share verified information through our official channels as it becomes available.
Please remain cautious of unofficial links, messages, or claims circulating during this time.
— Initia 🪢 (@initia) October 23, 2026
The reported technical assessment also distinguished the vulnerability from the network’s native INIT token, indicating that the flaw did not affect INIT directly. However, Initia had not publicly established the complete technical cause or confirmed the full scope of the exploit.
The suspension of both Initia’s base blockchain and its rollups was intended to contain the incident while investigators examined the vulnerability and coordinated with network participants.
Initia also warned users to remain cautious about unofficial links, messages, and claims circulating during the investigation. The incident highlights the risks associated with cross-chain infrastructure, where vulnerabilities in token issuance or transfer mechanisms can potentially allow assets to move between networks before operators intervene.
INIT Token Fluctuates Following Security Incident
Market data showed that INIT briefly fell to approximately $0.115 on Friday before recovering above $0.15. The token was subsequently reported near $0.1496, representing a gain of roughly 14% over the preceding 24 hours.
The recovery did not establish that the security incident had been resolved or that affected assets had been recovered. Market prices can fluctuate independently of the progress of a technical investigation.
Initia’s next steps include determining the vulnerability’s root cause, establishing the full extent of the affected assets, and coordinating with validators and exchanges. Until the team releases a definitive assessment, the reported loss figures and technical explanation remain preliminary.
