Initia halted operations across its layer-1 blockchain and all underlying rollups on Friday, October 23, 2026, at 15:41 UTC. The complete freeze was enacted following a security exploit that breached its token minting system. The move temporarily paused all transaction activity on the mainnet and its connected rollup ecosystem.
The incident came to light when security researcher Spreek flagged anomalous transactions on the network. Spreek was the first to issue an alert regarding the exploit, followed by technical confirmation from DeFi platform D2 Finance. However, the core issue goes beyond an operational pause, centering on how millions of dollars worth of tokens were minted without collateral.
Function Flaw Behind the Move Language
The root cause of the attack stems from the Move programming language underpinning Initia. The attacker exploited a specific function within the Move code that contained a logic vulnerability. This flaw allowed tokens to be minted without system authorization and with zero reserve collateral.
Leveraging that function flaw, the perpetrator minted 2 million unbacked AUSD tokens. Under the standard design of decentralized finance protocols, token issuance requires collateralizing equivalent assets within smart contracts. Once the collateral verification function failed, the AUSD tokens were credited directly to the attacker’s balance without any backing reserves.
Cross-Chain Withdrawal Route
After acquiring 2 million AUSD, the attacker moved the funds outside the Initia ecosystem, utilizing cross-chain transfer facilities to siphon off the loot. The perpetrator bridged approximately 1.4 million AUSD, 105 Ether (ETH), and 1.08 million USDC directly to the Ethereum network.
On the Ethereum network, all stolen assets were consolidated into a single primary wallet. According to on-chain records, this final destination wallet held 1,135.5 ETH. The estimated value of the assets stored in the wallet stood at around $2.73 million at the time of the transactions.
What Remains Unconfirmed
In response to the drained funds, the Initia developer team stated that they are coordinating with security researchers, validators, and crypto exchanges. The multi-party effort is focused on tracking the flow of stolen funds while formulating remediation measures.
Despite ongoing coordination, several key questions remain unanswered. As of publication time, the Initia team has yet to confirm the final loss amount resulting from the exploit. The $2.73 million figure in the attacker’s wallet represents an estimate based on identified assets rather than a final audited number from the developers.
Uncertainty also surrounds the network restart schedule. Initia has not yet released an estimated timeline for reopening the layer-1 system or the currently inactive rollups. For users and validators, resuming operations depends on the completion of the Move vulnerability patch before the blockchain is permitted to process new transactions.
Reported via Cointelegraph.
Also read: White House Halts $833M Foreign Crypto Network - 503 Fake Sites Shut Down Simultaneously
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
