Quick answer: In the Initia exploit on Oct. 23, 2026, Initia halted its layer-1 chain and rollups at 15:41 UTC after an attacker used a MoveVM bug to mint unbacked tokens and bridge out about $2.7 million in AUSD, ETH and USDC, per Initia, its co-founder and The Block.
The Initia exploit forced the layer-1 network and all of its rollups to stop at 15:41 UTC on Friday, Oct. 23, 2026. An attacker minted tokens with no backing and bridged out about $2.7 million in AUSD, ETH and USDC before the halt, according to Initia co-founder Zon.
What happened in the Initia exploit
Security researcher Spreek raised the alarm first. At 15:27 UTC he posted on X that the chain had been “hacked and a bunch of tokens infiniminted.” He added that the attacker had already cashed out $2.6 million, with more funds in flight.
Fourteen minutes later, the chain stopped. Initia confirmed on X that “the Initia L1 and Rollups have been halted due to a security incident” as of 3:41:30 PM UTC. The team said it was working with security firms, validators and exchanges to measure the damage.
Co-founder Ezaan Mangalji, known as Zon, then gave a first cause. He pointed to a “Day 0” bug in Initia’s MoveVM on the Cosmos SDK, The Block reported. The flaw allowed unauthorized minting, but it “does not apply to native INIT tokens,” he said. “The attacker was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused,” he added.
DeFi platform D2 Finance gave more detail, Cointelegraph reported. By its count, the attacker minted 2 million AUSD with no backing. Then the attacker withdrew about 1.4 million AUSD, 105 ETH and 1.08 million USDC to Ethereum. The funds ended up in one Ethereum wallet holding about 1,135.5 ETH, worth around $2.73 million.
Why the Initia exploit matters
This was not a theft from user wallets. Instead, the attacker created fake supply and used it to drain real assets from a bridge. Spreek explained it simply: the attacker “infinited the bridgeable tokens and bridged it back themselves draining the bridge contract.”
That has a direct cost for holders. Spreek warned that “the AUSD and similar is unbacked on initia right now.” In other words, bridged tokens on Initia may now carry less backing than their face value. Initia has not yet said how it will cover that gap.
The pattern is familiar. Less than a week earlier, an attacker minted 10 million CYS through the Cysic bridge, as we reported in our Cysic bridge exploit story. Earlier this month, Pirate Chain suffered a similar mint attack which we covered in our Pirate Chain exploit report. Each time, the weak point was the code that decides who can create new tokens.
Our view: a chain halt is a blunt tool, but here it likely worked. The pause came about 14 minutes after the first public report. As a result, it probably limited the outflows. However, it also shows how much power a small set of validators holds over a “decentralized” network.
Data and market context
The market barely blinked. INIT briefly fell to around $0.115 after the news, according to Cointelegraph, which cited CoinGecko. It then bounced above $0.15.
At 19:49 UTC on Oct. 23, 2026, INIT traded at $0.1535, up 16.8% over 24 hours, according to CoinGecko. Its market cap stood near $32.3 million. Meanwhile, 24-hour trading volume reached about $34.9 million, more than the token’s entire market cap. That points to heavy trading on the news, not calm holding.
One reason for the rebound is Zon’s statement that the bug did not touch native INIT. Still, the price can swing again once Initia publishes a full loss figure. For comparison, Ether traded at $2,394 and Bitcoin at $81,236 at the same time, both nearly flat on the day, per CoinGecko.
For wider context, our Q3 crypto hacks analysis found $1.18 billion in Q3 2026 losses, citing Hacken, with most attacks slipping past audits. Bridges and minting code keep showing up on that list.
What to watch next
First, watch for Initia’s post-mortem. The team has not confirmed the final loss or the exact bug yet. A clear root cause will show whether other Move-based chains face the same risk.
Second, watch the restart plan. Initia must decide how to handle the unbacked AUSD on its chain, and whether it will roll back, reimburse or reissue. Exchanges may also pause INIT deposits until the chain runs smoothly again.
Finally, watch the attacker’s Ethereum wallet. Cysic’s attacker sent funds to Tornado Cash within days, even after a bounty offer. Also expect scam “refund” links. Trust only Initia’s official channels. Our guide to DeFi risks covers bridge hacks and other common traps.
Initia exploit FAQ
Is INIT affected by the Initia exploit?
Initia co-founder Zon said the MoveVM bug “does not apply to native INIT tokens.” The attacker minted other tokens, such as AUSD, and bridged out about $2.7 million in AUSD, ETH and USDC, per The Block.
When will the Initia chain restart?
Initia had not given a restart date as of 19:49 UTC on Oct. 23, 2026. Initia said it would share confirmed updates through its official channels after it works with validators, exchanges and security teams.
Should I move my tokens off Initia?
You cannot move them while the chain is halted. Bridged assets such as AUSD may be undercollateralized until Initia sets out a recovery plan, so follow official updates and ignore unsolicited “claim” links.
Sources
- Initia on X: L1 and Rollups halted due to a security incident
- Spreek on X: first report of the Initia mint exploit
- The Block: Initia halts network after security incident as attacker reportedly mints tokens
- Cointelegraph: Initia halts blockchain after exploit reportedly drains over $2.6M
- Lookonchain: Initia co-founder says the attack involves MoveVM
- CoinGecko: Initia (INIT) price
This article is for information only and is not financial advice. Do your own research before you invest.
