Initia Halts L1 and Rollups After $2.7M Mint Exploit

Initia stopped producing blocks at 15:41:30 UTC on October 23, roughly forty-two minutes after an attacker minted 2,000,000 AUSD out of nothing and fourteen minutes after pseudonymous researcher Spreek flagged the activity on-chain. The project’s first notice called it “a security incident” and named none of the mechanics. Those mechanics arrived in fragments over the next day, and together they describe something narrower than a supply shock and sharper than a routine bug: an unauthorized mint that became real money the moment it touched a bridge.

As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident. Our team is actively investigating the situation and working to establish the full scope of any impact with security teams, validators, and exchanges. We will share verified information through our official channels as it becomes available. Please remain cautious of unofficial links, messages, or claims circulating during this time.

— Initia (@initia) October 23, 2026

Initia is a layer-1 blockchain built on the Cosmos SDK that hosts a network of interconnected rollups it calls Minitias. A halt of the base chain therefore takes the whole constellation offline, not a single application. What the first notice withheld, co-founder Ezaan Mangalji supplied separately. “To the best of our knowledge so far, this is a Day 0 bug related to Initia’s MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens,” he wrote, adding that the attacker “was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused.” The opening qualifier is load-bearing. Initia has not published a post-mortem, and its official account has not confirmed a final loss figure.

MoveVM is the virtual machine that executes smart contracts on Initia. A Day-0 bug is one that shipped in the original deployment, and the co-founder’s preliminary diagnosis places it inside Initia’s implementation of MoveVM on the Cosmos SDK. The exploit it enabled was minting — creating token balances without the authorization that normally precedes issuance. What the bug did not touch matters as much as what it did. Native INIT tokens were outside the exploit’s reach, so the incident did not inflate the supply of the chain’s own token.

That boundary separates this from the worst reading of an unauthorized mint. An attacker who prints the native token dilutes every holder at once, silently. An attacker who prints bridged representations of other assets — AUSD, ETH and USDC, as the co-founder listed — is constrained by the real collateral sitting behind those representations. The two loss figures circulating on day one show how fast that constraint moved. Spreek’s early estimate put the cash-out at $2.6 million while transfers were still moving; the co-founder’s later figure was “~$2.7m.” The roughly $100,000 gap is the money that kept moving after the first report.

The transaction trail, decoded by analytics firm D2 Finance, begins with a single signed transaction at 14:59:26 UTC that minted 2,000,000 AUSD on the Initia side. One hundred and fifty-three seconds later, a LayerZero message released 1.4 million real AUSD from the Ethereum-side adapter; 105 ETH followed at 15:06:47 UTC, and a further 1.08 million USDC arrived on Ethereum as fresh mints through Circle’s CCTP. By D2 Finance’s timestamps, $2.65 million was back on Ethereum within 7 minutes and 21 seconds of the mint — an extraction rate of roughly $6,000 per second across the span.

The mechanism is the part a post-mortem will have to explain. Initia’s bridged assets sit behind OFT adapters, lockbox contracts that hold real tokens and release them when the matching Initia-side balance is burned. An adapter can verify that tokens were burned; it cannot, in D2 Finance’s framing, “check whether burned tokens were ever backed.” The attacker therefore minted an unbacked claim, burned it, and collected real collateral. D2 Finance also noted a rollback that erased the burns would not erase the releases, which is why the make-whole question stays open. The bridge-versus-backing failure has already produced litigation in this ecosystem, including the $292 million rsETH dispute between Kelp DAO and LayerZero.

The sharpest reply came from Agora, the issuer of the AUSD stablecoin. “Agora has no smart contracts deployed on Initia,” the company wrote. “Our security team has been monitoring the situation and will freeze funds related to hacker addresses that hold AUSD on chains where AUSD/Agora smart contracts are deployed.” The statement distances the issuer from the exploit and, in the same breath, confirms that the 2 million “AUSD” minted on Initia was never Agora’s own token.

That is the article’s central tension. A ticker can read “AUSD” on two chains and mean two different things — Agora’s native issuance on one chain, and a bridged representation of it on another. The attacker exploited the second. Agora’s reassurance is that it can still freeze funds on chains where its real contracts live; the residual risk is that the bridged representation was backed by genuine AUSD held in the adapter’s lockbox, and that genuine AUSD has already moved. Cosmos-based networks have seen this failure before. In October, Cosmos Labs urged EVM chains to halt after KiiChain’s $148 million exploit, a sign that mint-and-bridge attacks have become a recurring failure mode across the ecosystem rather than a one-off bug.

A full chain halt is the bluntest instrument a network has, and Initia used it on purpose. Stopping consensus prevents the attacker from minting and bridging further, but it also freezes every legitimate user, application and validator on the network. The trade-off only makes sense if the team judged that the exploit could keep draining funds, which the early “funds still moving” language suggests was the case.

The market read the incident as contained. INIT, the native token, fell to about $0.115 on October 23 before rebounding above $0.15, per CoinGecko data — a response consistent with a bounded, non-dilutive exploit rather than a supply shock. What remains open is operational. Initia has not set a restart date, and its official account has not confirmed a final loss total or a specific technical cause. The chain was still halted more than six hours after the incident, stuck at block height 23365925.

What to watch next is procedural rather than speculative. Initia says it will share verified information through its official channels, and a post-mortem naming the exact MoveVM flaw and the make-whole plan is the next real signal. Until then the confirmed facts stay narrower than the circulating numbers: a chain was halted, a co-founder’s preliminary diagnosis pointed to a Day-0 MoveVM bug, and roughly $2.7 million in bridged assets left for Ethereum before anyone could pause the network.