At 15:41:30 UTC on October 23, 2026, Initia announced that its L1 and all of its rollups were halted following a security incident, with the team investigating the scope of the impact alongside security researchers, validators, and exchanges.

That single sentence — a network pausing itself mid-attack — is the story. Most exploits you read about are an app draining a pool while the chain underneath keeps humming. This one was serious enough that the chain itself hit the emergency brake.

What the Initia Exploit Actually Did

The first public flag came from blockchain researcher Spreek, who described an “infinimint” — an attacker with the ability to mint tokens without authorization, then swap the fresh units for assets that actually hold value. Spreek estimated roughly $2.6 million cashed out at the time of his first post, with additional funds still moving, The Block reported.

Initia co-founder Ezaan Mangalji, known as Zon, gave the first official accounting:

  • Preliminary findings point to a previously unknown “Day 0” bug in the network’s MoveVM implementation on Cosmos SDK that allowed unauthorized token minting.
  • The bug “does not apply to native INIT tokens.”
  • The attacker credited himself with unbacked WETH, iUSD and USDC — by spoofing MoveVM state, per Initia’s October 24 statement; the earlier framing called it “minting” — and bridged out ~$2.7 million before the chain was paused.

The most detailed breakdown so far comes from D2 Finance, as reported by Cointelegraph: the attacker exploited a vulnerability to mint 2 million AUSD without sufficient backing, then used cross-chain transfers to withdraw approximately 1.4 million AUSD, 105 ETH, and 1.08 million USDC to Ethereum. The stolen assets were consolidated into an Ethereum wallet holding roughly 1,135.5 ETH (~$2.73 million).

We have not independently verified the token-level figures in that breakdown; they are attributed to D2 Finance. Initia’s later statement does not repeat the “2 million AUSD minted” number, and instead describes spoofed state that credited unbacked WETH, iUSD and USDC — treat the two accounts as complementary until the post-mortem, not as one corrected figure.

What Initia Confirmed on October 24

Initia’s second statement, posted at 08:46 UTC on October 24, is the most specific account so far, and it moves the story on three points.

The mechanism. The attacker exploited “a bug in Initia MoveVM’s script caching that allowed malicious code to bypass security checks.” In plain terms: the VM cached a compiled script and then ran it with checks that should have applied to a different, validated script. That let the attacker artificially spoof the MoveVM state, crediting himself with unbacked WETH, iUSD and USDC without changing any of those tokens’ total supply — a bookkeeping lie inside the VM rather than a mint that shows up in supply statistics. Initia says no native INIT was created and INIT’s total supply is unaffected.

The window and the exit routes. Initia dates the exploit to 14:59 UTC on October 23 — 42 minutes before the halt. In that window the attacker bridged out roughly $2.7 million: 105 WETH and ~1.4M AUSD0 through LayerZero, plus ~1.08M USDC through Noble and CCTP. Those were swapped for 1,135.52 ETH, which Initia says now sits at 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8 on Ethereum mainnet.

We checked that wallet ourselves. Reading Ethereum mainnet on October 24, we see the address holding 1,135.5247 ETH, with a single inbound transfer of 1,135.5246 ETH at 15:41:35 UTC on October 23 — five seconds after the halt was announced — and no outbound ETH or token transfer since. The dollar total remains an estimate from claim-time pricing; the ETH balance and the timing are facts.

What Initia says happens next: a fix is expected “to be completed and audited in a few days”; asset recovery is ongoing with security partners; the L1 and rollups stay halted until then; and a full post-mortem is promised “once available.”

Where the Bug Lives — Still Two Stories

Here is the part worth slowing down on. Within hours, two incompatible narratives emerged:

Narrative one — core chain infrastructure. Both the co-founder’s first statement and Initia’s October 24 thread point at the chain’s own execution layer: first a “Day 0” bug in the MoveVM implementation on Cosmos SDK, then specifically the MoveVM script cache. If that holds, this is a bug in the foundation, not an application — the most serious class of chain-level flaw, and one that would have been inherited by every rollup running the same VM.

Narrative two — a third-party product. AUSD issuer Agora told The Defiant that the exploit hit a third-party product using AUSD, and that Agora has no smart contracts deployed on Initia at all. Ethereum records show the 1.4 million stablecoin exiting a bridge adapter.

Those still do not fully reconcile. Initia’s thread names a chain-level bug and says the bridged stablecoin was AUSD0 sent through LayerZero — while Agora describes its own token as AUSD and denies having contracts on Initia at all. We could not establish whether AUSD0 is Agora’s AUSD under a different ticker, a bridged representation, or a separate issuance. A core VM flaw can be exercised through a third-party token without making the token issuer responsible, so both statements can be true at once — but the naming gap means the responsibility question stays open until the post-mortem.

What the Halting Actually Did

A full-chain halt is a blunt instrument with a specific purpose: no new blocks means no new transactions, which means the attacker cannot mint more or stage another exit on-network. The cost is that every legitimate user is frozen too — no transfers, no DeFi, nothing processes.

In this case the brake worked as a cap but not a containment: roughly $2.7 million had already bridged to Ethereum before the pause, where Initia has no ability to stop anything. Once funds are on a chain the attacker fully controls timing on, recovery depends on the old toolkit — exchange freezes, stablecoin issuer blacklisting, law enforcement.

Market and Exchange Reaction

INIT fell about 14% immediately after the exploit reports, touching roughly $0.115, then rebounded above $0.15 — trading up ~14% on the day, per CoinGecko data cited by Cointelegraph. A halt that stops an attacker also stops sellers, and the co-founder’s “INIT itself was not minted” statement gave the market a floor to bet on.

On October 24 KST, Korean exchanges moved: Upbit and Bithumb suspended INIT deposits and withdrawals and issued investment warnings, and Coinone posted a formal caution notice. Korea is a major INIT trading market, which is why the warnings landed there first.

What to Watch — and What to Ignore

For anyone holding INIT or assets on Initia:

  • Watch only the official channel. Initia’s X account is the source for the post-mortem, the restart timeline, and any remediation plan. Everything else is commentary.
  • Expect the post-incident scam wave. After every major incident, fake “compensation claim” sites, fake refund bridges, and impersonator support accounts appear within days. There is no legitimate third-party claims process that needs your seed phrase or signature — if something asks, it’s theft, the same pattern we documented in our guide to fake recovery services.
  • Distinguish asset classes. Native INIT was reportedly not minted; the damage concentrated in bridged and wrapped assets (AUSD, USDC, ETH routes). If you held bridge-receipt tokens, your exposure is to how Initia honors the pre-exploit ledger at restart — a question our access control attacks explainer covers in the unauthorized-mint family.
  • Chain-level incidents have restart risk. When a halted chain comes back, it comes back with a snapshot decision — what state gets preserved, what gets rolled back. That is a governance question, not just a technical one, as the Abstract chain shutdown and NEAR Intents incident both showed in different ways.

Initia previously weathered a 2025 staking-rewards configuration error that was resolved through governance rather than exploited. How cleanly this one is post-mortemed, remediated, and restarted will say a lot more about the network than the bug itself.

Frequently Asked Questions

Was INIT itself minted in the Initia hack?

No, per the co-founder's preliminary statement — the unauthorized minting 'does not apply to native INIT tokens.' What got minted was other tokens, reportedly 2 million AUSD without backing, which were then swapped and bridged to Ethereum as AUSD, ETH, and USDC worth roughly $2.7 million.

Why did Initia halt the whole chain?

Halting the L1 and rollups is an emergency brake: it stops new blocks, which stops the attacker from minting more or moving more funds on-network. In this case it came too late to stop about $2.7 million from bridging out to Ethereum before the pause, but it capped further minting.

Is the root cause of the Initia exploit known?

Partly. On October 24 Initia attributed it to a bug in the Initia MoveVM's script cache that let malicious code bypass security checks, allowing the attacker to spoof MoveVM state and credit unbacked WETH, iUSD and USDC without changing total supply. That is a chain-level bug in a preliminary statement, not a final post-mortem — and AUSD issuer Agora still says the exploit hit a third-party product and that it has no contracts on Initia. Treat the root cause as named but not closed.

Where are the stolen funds now?

On Ethereum. Initia says the bridged assets were swapped for 1,135.52 ETH and now sit at 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. We checked the address on October 24: it holds 1,135.5247 ETH, received in a single inbound transfer at 15:41:35 UTC on October 23, with no outbound transfers since. Asset recovery is ongoing with security partners; nothing has been returned.

What should INIT holders and Initia users do now?

Treat the situation as developing: the L1 and rollups are still halted, deposits and withdrawals are suspended on several exchanges, and Initia says the fix will take a few days to complete and audit. Watch only Initia's official X account for the post-mortem and restart plan — and expect scammers to launch fake 'compensation' sites and refund flows within days, which happens after every major incident.