A security exploit on Initia reportedly enabled unauthorized token minting and the movement of millions of dollars in digital assets to Ethereum, prompting the team behind the Layer 1 network to halt the blockchain and its associated rollups.

According to an announcement from Initia, the halt took effect at 3:41:30 p.m. UTC on October 23. The team said it is working with security researchers, validators, and cryptocurrency exchanges to investigate the incident and assess its impact.

The exploit reportedly involved the unauthorized creation of 2 million AUSD tokens, followed by cross-chain transfers that moved stablecoins and Ether to Ethereum before the network was suspended. At the time of reporting, Initia had not confirmed the total financial losses or disclosed a definitive explanation of the vulnerability.

Attackers Reportedly Move Millions to Ethereum

Blockchain security researcher Spreek was the first to flag the incident, reporting that an attacker had minted tokens without authorization and converted approximately $2.6 million in assets. Additional funds were reportedly still being moved as the investigation developed.

Decentralized finance platform D2 Finance subsequently provided further detail about the suspected attack. According to its account, the attacker exploited a vulnerability to create 2 million AUSD tokens without sufficient backing, then used cross-chain transfers to move approximately 1.4 million AUSD, 105 Ether (ETH), and 1.08 million USD Coin (USDC) to Ethereum.

The transferred assets were reportedly consolidated into an Ethereum wallet holding approximately 1,135.5 ETH, valued at about $2.73 million. Blockchain transaction records also indicated that the stablecoins were exchanged before the resulting Ether was transferred.

The reported figures represent estimates from external observers rather than a final loss assessment from Initia. The precise amount affected and the complete sequence of transactions remained subject to investigation, and any confirmed accounting of the losses would need to come from the team itself.

Dispute Emerges Over AUSD Minting Claims

Agora, the issuer associated with AUSD, disputed the account linking the token's unauthorized minting directly to its infrastructure on Initia. The company said it did not have smart contracts deployed on the network, raising questions how the reported token creation occurred and which components were involved.

Agora also outlined the limits of its ability to freeze assets, saying its response would focus on relevant hacker addresses holding AUSD on blockchains where its own smart contracts are deployed. The distinction is significant, because freezing tokens through an issuer-controlled contract differs from stopping transactions on another blockchain or recovering assets that have already been transferred. The effectiveness of any intervention would therefore depend on the contracts and networks involved.

Preliminary Findings Point to a MoveVM Vulnerability

Preliminary findings attributed to Initia co-founder Ezaan Mangalji, also known as Zon, reportedly pointed to a previously unknown vulnerability in the network's MoveVM implementation operating with the Cosmos SDK. MoveVM executes smart contracts written in Move, a programming language originally developed for Meta's Diem project and later adopted by Layer 1 networks such as Aptos and Sui, while the Cosmos SDK is a widely used open-source framework for building application-specific blockchains. Move's resource-oriented model treats digital assets as unique, non-duplicable objects, an asset-safety design that has been central to its appeal among network builders. The suspected flaw was described as a zero-day vulnerability, meaning it was not previously known or addressed when it was exploited, and the preliminary account indicated that it could allow unauthorized token minting.

As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident. Our team is actively investigating the situation and working to establish the full scope of any impact with security teams, validators, and exchanges. We will share verified information through our official channels as it becomes available. Please remain cautious of unofficial links, messages, or claims circulating during this time.

— Initia (@initia) October 23, 2026

The reported technical assessment also distinguished the vulnerability from the network's native INIT token, indicating that the flaw did not affect INIT directly. However, Initia had not publicly established the complete technical cause or confirmed the full scope of the exploit.

The suspension of both Initia's base blockchain and its rollups was intended to contain the incident while investigators examined the vulnerability and coordinated with network participants. Rollups are execution networks that post their activity back to an underlying base chain, so their operation is tied to the Layer 1's own status; while the halt remained in effect, transactions on the network and its rollups could not be processed. Initia also warned users to remain cautious about unofficial links, messages, and claims circulating during the investigation.

The incident highlights the risks associated with cross-chain infrastructure, where vulnerabilities in token issuance or transfer mechanisms can potentially allow assets to move between networks before operators are able to intervene.

INIT Token Fluctuates Following Security Incident

INIT is the native token of the Initia network. Market data showed that it briefly fell to approximately $0.115 on Friday before recovering above $0.15, and it was subsequently reported near $0.1496, representing a gain of roughly 14% over the preceding 24 hours.

The price recovery did not establish that the security incident had been resolved or that affected assets had been recovered. Market prices can fluctuate independently of the progress of a technical investigation.

Initia's next steps include determining the vulnerability's root cause, establishing the full extent of the affected assets, and coordinating with validators and exchanges. Until the team releases a definitive assessment, the reported loss figures and technical explanation remain preliminary.