An address tied to the Initia exploit sent approximately 1,135 ETH, worth more than $2.7 million, to a second Ethereum wallet on Friday, per on-chain records. Initia halted its Layer 1 and all of its rollups at 15:41:30 UTC, five seconds before the transfer settled.

On-chain analyst Spreek raised the alarm at 15:27 UTC. "Initia chain hacked and a bunch of tokens infiniminted. Hacker has cashed out $2.6m thus far with more in flight," he wrote on X.

Swaps preceded the alert; Agora attacker address

Before the large transfer, the same address swapped 1.4 million AUSD — the dollar stablecoin issued by Agora — and roughly 1 million USDC into ETH via 1inch, a decentralized exchange aggregator. Both transactions took place between 15:03 and 15:05 UTC, more than 20 minutes before the first public alert.

Spreek said the attacker created bridgeable tokens on Initia without backing and then bridged them out, draining the bridge contract. "effectively means the AUSD and similar is unbacked on initia right now," he said.

At 18:04 UTC, the receiving wallet still held the 1,135.5 ETH, and no outgoing transaction had been registered, leaving the full balance visible at a known address on the public blockchain. Separately, AUSD issuer Agora froze the attacker's first Ethereum address at 16:31:59 UTC.

The freeze came after the swaps were complete, and the address already held zero AUSD. Agora also stated that it "has no smart contracts deployed on Initia," meaning the freeze only affects chains where AUSD contracts are deployed.

Upbit suspends INIT deposits and withdrawals

"As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident," Initia said on X. The team is working with security professionals and exchanges to assess the extent of the damage.

Co-founder Ezaan Mangalji said he believes a newly discovered software flaw allowed the hacker to create tokens and extract about $2.7 million. Initia's server showed the final block, 23,365,925, was produced at the moment of the shutdown.

The base chain manages bridging and liquidity for all Initia rollups. With it stopped, transfers and trading on InitiaDEX froze for all users, including INIT holders.

Upbit said in its notice that it halted INIT deposits and withdrawals at 15:57 UTC, citing signs of the security incident on the network. Trading continues, and the exchange said transfers would resume only once it is satisfied that deposits and withdrawals are stable. For INIT holders, the next concrete markers are Initia's assessment of the damage and Upbit's conditions for restoring transfers.

INIT sank 14% at the time of the exploit disclosure. The token later reversed those losses and was trading about 14% higher on the day as of 17:03 UTC.

The incident follows a string of similar bridge exploits, with unauthorized token creation at a bridge as the common thread. On October 17, a Cysic attacker forged a mint message and withdrew 10 million unauthorized CYS from the bridge, according to Cryptopolitan. In August, Cryptopolitan reported on what appeared to be a 4 billion ONE mint on Harmony.