Initia has halted its Layer 1 blockchain and connected rollups after an attacker exploited a previously unknown software vulnerability to mint unauthorized tokens and withdraw approximately $
Initia has halted its Layer 1 blockchain and connected rollups after an attacker exploited a previously unknown software vulnerability to mint unauthorized tokens and withdraw approximately $2.7 million in cryptocurrency from cross-chain bridge reserves.
The network stopped processing transactions at 15:41:30 UTC on October 23, 2026, leaving users unable to transact across Initia’s interconnected blockchain infrastructure. The attacker had already moved AUSD, Ethereum (ETH) and USDC to Ethereum before validators coordinated the emergency shutdown.
Initia co-founder Ezaan Mangalji identified a previously unknown flaw in the network’s Move Virtual Machine (MoveVM) implementation on Cosmos SDK. The vulnerability enabled unauthorized token creation on the base blockchain but did not allow the attacker to mint additional native INIT tokens.
The exploit began at approximately 14:59 UTC, when the attacker executed malicious transactions that generated unbacked representations of assets normally transferred into Initia through cross-chain bridges.
An onchain investigation by Bitquery traced approximately $7.48 million in unauthorized token creation at nominal face value, executed in four batches over 13 seconds. However, much of that amount consisted of synthetic iUSD that could not be redeemed at its stated value.
The attacker successfully extracted approximately $2.73 million in real assets from bridge reserves backing AUSD, ETH and USDC on Initia.
The withdrawals exploited the relationship between tokens issued on Initia and their underlying assets held on other networks. Unauthorized balances could be burned through otherwise legitimate bridge transactions, releasing real cryptocurrency from the corresponding reserves.
Approximately 1.4 million AUSD and 105 ETH were released through Ethereum-side LayerZero adapters, while another 1.08 million USDC moved through Noble and Circle’s Cross-Chain Transfer Protocol (CCTP).
The stolen assets were subsequently converted into approximately 1,135.5 ETH and consolidated in an Ethereum wallet.
The incident follows the recent Cysic bridge exploit, where an attacker minted 10 million unauthorized CYS tokens and transferred approximately $727,000 in proceeds to Ethereum.
The attack significantly reduced liquidity backing bridged assets on Initia, creating immediate withdrawal problems for legitimate users.
Noble’s USDC reserve, which initially held approximately $1.09 million, fell to just $63 during the incident and subsequent withdrawals. The depleted balance prevented further redemptions, with 55 unsuccessful withdrawal attempts recorded before the network halt, many involving repeated requests from the same trading bot.
The Ethereum-side ETH reserve lost approximately 96% of its holdings, while the AUSD adapter was depleted by roughly 71%.
Similar reserve vulnerabilities previously affected the Liquid Network, which suspended operations in September after nearly 4,000 BTC left its federation wallet through an unauthorized peg-out.
Agora, the issuer of AUSD, confirmed that its own stablecoin infrastructure was unaffected. The company has no native AUSD contracts deployed on Initia, and its existing stablecoin reserves remain fully backed.
Agora also committed to freezing attacker-linked AUSD balances on supported networks. However, the stolen AUSD had already been converted into ETH before that intervention, and no completed freeze of those proceeds has been established.
South Korean exchange Upbit temporarily suspended INIT deposits and withdrawals following the security incident and issued a trading caution notice. Spot trading was not suspended as part of that initial action.
KuCoin also suspended INIT deposits and withdrawals on October 24, citing essential network maintenance.
Initia is working with security specialists, validators and cryptocurrency exchanges to determine the full scope of the vulnerability and assess losses across the affected bridges.
The investigation has not established a final financial loss, a complete technical root cause or a compensation arrangement for affected users. No patch release or confirmed network restart date has been announced.
Initia has warned users to avoid unofficial recovery links and suspicious messages while the Layer 1 blockchain and connected rollups remain suspended.
The post Initia Halts Network After $2.7 Million MoveVM Token Minting Exploit appeared first on Crypto Adventure.
