Initia has halted its Layer 1 blockchain and all connected rollups after an attacker exploited a previously unknown software vulnerability to mint unauthorized tokens and drain approximately $2.7 million in cryptocurrency from cross-chain bridge reserves.

The network stopped processing transactions at 15:41:30 UTC on October 23, 2026, leaving users unable to transact across Initia's interconnected blockchain infrastructure. By the time validators coordinated the emergency shutdown, the attacker had already moved AUSD, Ethereum (ETH), and USDC to Ethereum.

Initia co-founder Ezaan Mangalji identified a previously unknown flaw in the network's Move Virtual Machine (MoveVM) implementation on Cosmos SDK, as stated in an X post. The vulnerability enabled unauthorized token creation on the base blockchain, though it did not allow the attacker to mint additional native INIT tokens.

Attacker Minted Unbacked Tokens and Drained Bridge Reserves

The exploit began at approximately 14:59 UTC, when the attacker executed malicious transactions that generated unbacked representations of assets normally transferred into Initia through cross-chain bridges.

An on-chain investigation by Bitquery traced approximately $7.48 million in unauthorized token creation at nominal face value, executed in four batches over 13 seconds. Much of that amount, however, consisted of synthetic iUSD that could not be redeemed at its stated value.

The attacker successfully extracted approximately $2.73 million in real assets from the bridge reserves backing AUSD, ETH, and USDC on Initia. The withdrawals exploited the relationship between tokens issued on Initia and their underlying assets held on other networks: unauthorized balances could be burned through otherwise legitimate bridge transactions, releasing real cryptocurrency from the corresponding reserves.

Approximately 1.4 million AUSD and 105 ETH were released through Ethereum-side LayerZero adapters, while another 1.08 million USDC moved through Noble and Circle's Cross-Chain Transfer Protocol (CCTP). The stolen assets were subsequently converted into approximately 1,135.5 ETH and consolidated in an Ethereum wallet.

The incident follows the Cysic bridge exploit, in which an attacker minted 10 million unauthorized CYS tokens and transferred approximately $727,000 in proceeds to Ethereum.

USDC Reserve Nearly Emptied as Agora Responds

The attack significantly reduced the liquidity backing Initia's bridged assets, creating immediate withdrawal problems for legitimate users. Noble's USDC reserve, which initially held approximately $1.09 million, fell to just $63 during the incident and subsequent withdrawals. The depleted balance prevented further redemptions, and 55 unsuccessful withdrawal attempts were recorded before the network halt, many involving repeated requests from the same trading bot.

The Ethereum-side ETH reserve lost approximately 96% of its holdings, while the AUSD adapter was depleted by roughly 71%.

Similar reserve vulnerabilities previously affected the Liquid Network, which suspended operations in September after nearly 4,000 BTC left its federation wallet through an unauthorized peg-out.

Agora, the issuer of AUSD, confirmed on X that its own stablecoin infrastructure was unaffected. The company has no native AUSD contracts deployed on Initia, and its existing stablecoin reserves remain fully backed. This distinguishes the affected Initia-side AUSD representation and bridge reserves from Agora's native AUSD contracts and existing stablecoin reserves. Agora also committed to freezing attacker-linked AUSD balances on supported networks. However, the stolen AUSD had already been converted into ETH before that intervention, and no completed freeze of those proceeds has been established.

Exchanges Suspend INIT Transfers as Investigation Continues

South Korean exchange Upbit temporarily suspended INIT deposits and withdrawals following the security incident and issued a trading caution notice. Spot trading was not suspended as part of that initial action. KuCoin also suspended INIT deposits and withdrawals on October 24, citing essential network maintenance, according to an official announcement.

Initia, which announced the shutdown on X, is working with security specialists, validators, and cryptocurrency exchanges to determine the full scope of the vulnerability and assess losses across the affected bridges. The investigation has not established a final financial loss, a complete technical root cause, or a compensation arrangement for affected users. No patch release or confirmed network restart date has been announced.

Initia has warned users to avoid unofficial recovery links and suspicious messages while the Layer 1 blockchain and connected rollups remain suspended.