Initia halts L1 and rollups after reported $2.6M exploit

What happened

Initia stopped its layer-1 blockchain and its connected rollups after a security incident, the project said in a statement on X. The halt took effect at 3:41:30 p.m. UTC on Oct. 23. Initia said it was working with security researchers, validators and exchanges to measure the impact, and it asked users to rely on official channels for verified updates while warning about unofficial links and claims.

The first public alarm came from blockchain security researcher Spreek, who reported that someone had minted tokens without authorization and moved roughly $2.6 million into other assets, with more funds still in transit at the time. D2 Finance later gave a more detailed account, saying the attacker created 2 million AUSD tokens without enough backing and used cross-chain transfers to send about 1.4 million AUSD, 105 ETH and 1.08 million USDC to Ethereum. Those assets were later gathered in an Ethereum wallet holding about 1,135.5 ETH, which D2 Finance valued at $2.73 million, according to reports from Cointelegraph and Crypto.news.

Initia co-founder Ezaan Mangalji later described the issue as a Day 0 bug involving Initia's MoveVM on CosmosSDK, saying it let the attacker mint extra tokens on the Initia L1 but did not apply to native INIT tokens. He said the attacker minted and bridged out about $2.7 million worth of AUSD, ETH and USDC before the chain was paused, Bitcoin.com News reported. Initia's initial public statement did not confirm a loss figure or identify the vulnerability, and it gave no restart date.

Why it matters

Initia is built to coordinate a network of interconnected rollups, called Minitias, so a halt at the base layer can affect applications and appchains that depend on it. The incident therefore goes beyond a single decentralized application: it raises questions about how security flaws in shared infrastructure can interrupt activity across an ecosystem. The disruption also reached exchange access, with South Korea's Upbit suspending INIT deposits and withdrawals. At the same time, Agora's statement that it has no smart contracts on Initia and that AUSD does not exist on the network complicates the early account and shows why investigators have not settled on a single description of the attack.

What the data shows

The numbers reported so far come from different observers and have not been reconciled into a final loss total. Spreek's early estimate was about $2.6 million already cashed out, while Mangalji put the minted and bridged amount at about $2.7 million. D2 Finance's account listed 2 million unbacked AUSD, withdrawals of 1.4 million AUSD, 105 ETH and 1.08 million USDC, and a consolidation wallet with 1,135.5 ETH valued at $2.73 million. Bitcoin.com News reported that the chain was still halted about seven hours after the incident and stuck at block height 23,365,925. Cointelegraph reported that INIT briefly fell to around $0.115 before recovering above $0.15 and trading near $0.1496, up about 14% over 24 hours; Bitcoin.com News cited a 12.5% 24-hour gain and a 65.8% rise over 30 days.

Background

Initia's design pairs a base blockchain with application-specific rollups. In February 2024, Crypto.news reported that the startup raised $7.5 million in seed funding co-led by Delphi Ventures and Hack VC, with Nascent and Figment Capital also participating; the money was intended to support testnet work. In July 2024, LayerZero Labs and Initia Labs announced plans to develop an interoperability standard for Cosmos, described as a Cosmos SDK module intended to connect applications across supported networks. In November 2024, lending protocol Echelon said it would build a Move appchain on Initia's Interwoven Stack and Celestia's modular technology, with planned links to Initia's L1 and a native liquidity hub.

What is still unclear

Several central questions remain open. Initia has not confirmed the total financial damage, identified which applications or users were affected, or said when the L1 and rollups will restart. The relationship between the allegedly created tokens, the bridge transfers and the assets received on Ethereum still needs to be established by the project's technical investigation. Agora's denial that AUSD was minted on Initia also conflicts with the earlier D2 Finance description, leaving the exact role of the stablecoin unresolved. Cointelegraph said it could not reach Initia for comment through the project's official X account.

What to watch

The next useful signals will be Initia's technical postmortem, any validator and exchange updates, and a confirmed restart plan. Also worth watching is whether Agora freezes AUSD linked to attacker addresses on networks where its contracts are deployed, as it said it would. Confirmation of user losses, a reconciled total and the chain's block height at restart would clarify the scope.

Questions readers ask