Initia Halts Layer-1 Network and Rollups After $2.6 Million Token

Initia, a layer-1 blockchain built to host a network of interconnected application-specific rollups, stopped producing blocks on its base chain and all connected rollups Friday after an attacker created tokens without authorization and converted them into roughly $2.6 million in other crypto assets.

The halt took effect at 3:41:30 p.m. UTC on Oct. 23, according to a statement the project posted on X. Initia said it was working with security researchers, validators and exchanges to determine the full scope of the incident and would verified information through official channels as it became available. The announcement confirmed a security incident but did not estimate losses, identify the vulnerability or give a timetable for restarting the network.

The first public warning came from blockchain security researcher Spreek, who reported that an attacker had minted tokens without permission and cashed out $2.6 million, with more funds still in motion at the time of the post. That figure remains an early estimate rather than a reconciled total.

DeFi platform D2 Finance subsequently published a more granular account, saying the attacker exploited a vulnerability to create 2 million AUSD tokens without sufficient backing, then moved roughly 1.4 million AUSD, 105 ether and 1.08 million USDC across chains to Ethereum. The proceeds were later consolidated into a single Ethereum wallet holding 1,135.5 ETH, which D2 Finance valued at approximately $2.73 million. The firm traced the root cause to a flaw in a Move function that allegedly allowed unbacked tokens to be created and swapped for assets on Ethereum.

Agora, the issuer behind AUSD, disputed part of that account. The company said the incident involved a third-party product using AUSD and that it has no smart contracts deployed on Initia. The precise relationship between the allegedly created tokens, the bridge transfers and the assets received on Ethereum has not been confirmed by the project's own technical investigation.

Note: Loss figures come from third-party analyses and have not been confirmed by Initia as a final, reconciled total.

Because Initia's design ties its application chains, often called Minitias, to the base layer, the pause freezes activity well beyond a single contract. Transactions submitted during the outage sit unconfirmed, and settlement finality for recent bridge transfers is unclear until validators agree on the canonical state. The halt is best read as containment: it blocks further unauthorized minting and limits the attacker's ability to swap fraudulent supply, but it also locks legitimate users in place.

Several questions remain open. It is not yet public whether the minted tokens were frozen, burned or absorbed into circulating supply, and each option carries different consequences for holders. A state rollback or supply burn would require validator coordination and could introduce complications of its own. The status of funds that may have left the network before the halt also matters for exchanges and bridges that list Initia assets. Most importantly, the root cause has not been established; a minting exploit can stem from a contract logic flaw, a compromised admin key, a misconfigured permission system or a deeper consensus-layer weakness, and the fix and safe restart timeline depend on which it is.

Market reaction was sharp but short-lived. INIT briefly fell to around $0.115 before recovering above $0.15, and was trading near $0.1496 at one point, up 14% over the prior 24 hours, according to CoinGecko data. South Korea's Upbit posted an investment caution notice on Initia shortly after the incident. A rebound in the token does not by itself show the exploit is contained or that final losses are limited; prices during security incidents often track shifting expectations severity and remediation speed.

Initia's architecture grew out of a February 2024 seed round of $7.5 million co-led by Delphi Ventures and Hack VC, with Nascent and Figment Capital participating, aimed at building out its testnet. By July 2024, LayerZero Labs and Initia Labs had announced plans for an interoperability standard for Cosmos, and in November 2024 lending protocol Echelon said it would build a Move appchain on Initia's Interwoven Stack and Celestia's modular technology.

The immediate focus for users and counterparties is whether Initia publishes a post-mortem naming the vulnerability, a clearer loss estimate and conditions for a restart. Validators would typically need to agree on a patched binary before new blocks are produced, and a security review should precede any public restart announcement. Until then, projects and venues holding or pricing Initia-linked assets have no reliable basis for judging when normal activity can resume.