A hacker exploited a previously unknown bug in Initia's blockchain infrastructure on October 23, 2026, minting and bridging out roughly $2.7 million in digital assets before the network's val
A hacker exploited a previously unknown bug in Initia's blockchain infrastructure on October 23, 2026, minting and bridging out roughly $2.7 million in digital assets before the network's validators halted the chain entirely, freezing all transactions across its L1 and connected rollups.
Initia's official account confirmed that, as of 3:41:30 PM UTC on October 23, its L1 and rollups had been halted in response to a security incident. The pause was a deliberate defensive measure, not a network crash, and it stopped all on-chain activity while the team investigated the scope of the breach. For related coverage, see Fed Experiment Shows Bitcoin Rallies Attract New Crypto Buyers.
Co-founder Ezaan Mangalji attributed the incident to a Day 0 bug in Initia's MoveVM implementation on CosmosSDK. According to Mangalji, the flaw allowed the attacker to mint additional tokens directly on the Initia L1, sidestepping normal issuance controls entirely. For related coverage, see Bitcoin Near Range Highs: Why $85,000 Is the Key Ceiling.
to the best of our knowledge so far, this is a Day 0 bug related to Initia's MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens.the attacker was able to mint and bridge out ~$2.7m worth of AUSD,ā¦ https://t.co/bHh6FdirVu For related coverage, see Future Leaders Awards & Conference 2026 to Bring Global Business and Technology Leaders to Singapore on 2ā3 November.
ā zon šŖ¢ (@ItsAlwaysZonny) October 23, 2026
Mangalji said the attacker minted and bridged out approximately $2.7 million in AUSD, ETH, and USDC before the chain was paused. The funds left the Initia ecosystem via bridging infrastructure, meaning the attacker had already moved assets to other networks by the time the halt took effect.
Reported exploit exposure ~$2.7M The amount reportedly minted and bridged before Initia paused its chain; it is an early estimate, not a final reconciled loss figure.Importantly, Mangalji stressed that native INIT tokens were not affected by the described bug. The vulnerability was specific to the MoveVM module's token minting logic, not to the chain's base-layer asset. The final scope, total loss figure, and definitive root cause remain under active investigation, according to the team's initial statement.
When Initia's L1 went dark, every rollup built on top of it followed. The halt interrupted transaction processing across the entire Initia ecosystem, affecting any application, bridge, or user with pending activity at the time. The chain remained halted when secondary reporting was published. South Korean exchange Upbit also suspended INIT deposits and withdrawals following the incident, reflecting the standard exchange response to a live chain-security event.
This kind of coordinated halt is a legitimate crisis-management tool for Cosmos-based chains, where validators can reach social consensus to stop block production. It prevents further exploit transactions but also means legitimate users cannot move funds until the chain restarts under a patched binary.
Any transaction submitted to the Initia L1 during the halt window is effectively suspended. Applications relying on Initia's rollup infrastructure, including any projects using AUSD as a stablecoin layer, could not process user actions while the chain was paused. Stablecoin issuer Agora moved quickly to contain cross-chain exposure. The company said it has no smart contracts deployed on Initia itself, and its security team committed to freezing funds linked to hacker addresses that hold AUSD on chains where Agora's smart contracts are deployed.
We're aware of today's security incident on Initia. Agora has no smart contracts deployed on Initia. Our security team has been monitoring the situation and will freeze funds related to hacker addresses that hold AUSD on chains where AUSD/Agora smart contracts are deployed.
ā Agora (@withAUSD) October 23, 2026
Agora's response highlights how cross-chain asset issuers can act as a secondary defense layer when a host chain is compromised. By blacklisting attacker addresses at the contract level on other networks, the issuer can effectively strand funds that have already bridged out, reducing the attacker's ability to liquidate stolen assets. This dynamic is a meaningful feature of programmable stablecoin infrastructure that pure on-chain attackers often underestimate.
Because the bug targeted non-native assets, INIT token holders faced a different risk profile than the direct victims of the minting exploit. At the time of the research snapshot, INIT was priced at $0.132268, down 1.83% over 24 hours, with approximately $33.45 million in 24-hour trading volume against a market capitalization of roughly $27.9 million. The 24-hour volume figure exceeding the total market cap indicates unusually elevated turnover, consistent with a security-event sell-off and reactive trading rather than ordinary liquidity patterns.
INIT price at research capture $0.132268 ā1.83% over 24 hours Snapshot data also showed roughly $33.45 million in 24-hour trading volume. This native-token market reading should not be treated as a measure of the reported non-native asset exposure.The broader Crypto Fear & Greed Index stood at 51 (Neutral) at the time of the snapshot, suggesting the incident had not yet produced a market-wide fear response beyond Initia's own token activity.
Initia said it was working with security teams, validators, and exchanges to investigate the full scope of the incident. The key milestones ahead include: a confirmed root cause and patch, a coordinated validator upgrade to the patched binary, a supervised chain restart, and a post-incident report reconciling the $2.7 million figure against on-chain evidence. Until an official post-mortem is published, the $2.7 million figure should be treated as an early estimate rather than a final loss number.
Incidents of this type, where a bridge-enabled chain exploit enables rapid asset extraction before a halt, have become a recurring pattern in Cosmos-based infrastructure. A similar cross-chain movement pattern was documented in the Coldcard/THORChain incident, where an attacker used interoperability infrastructure to convert stolen assets before responders could react. The speed of bridging is a structural challenge that no single protocol can solve unilaterally.
Users and builders with active positions or deployments on Initia should rely exclusively on official announcements from the Initia team before taking any action. Phishing attempts and fake recovery schemes routinely follow high-profile chain halts; treat any unsolicited link or wallet-connection request related to this incident as malicious until verified through Initia's own communication channels. Developers building on Initia's rollup stack or using AUSD as a settlement layer should monitor Agora's official channels for updates on address blacklisting and contract-level protections, similar to what institutional operators managing multi-asset crypto positions routinely track during security events affecting underlying infrastructure.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on nftenex.com
