Initia Halts Blockchain After $2.6 Million Exploit

Initia halted its layer-1 blockchain and connected rollups on Oct. 23 after security researchers identified an exploit that allowed an attacker to mint tokens without authorization and transfer more than $2.6 million in crypto assets to Ethereum.

The network was halted at 3:41 p.m. UTC after the incident was detected. Initia reported in a post on X that it was working with security researchers, validators and cryptocurrency exchanges to assess the impact.

Security researcher Spreek reported that the attacker had minted tokens and converted about $2.6 million into other assets, with additional funds still being moved. DeFi platform D2 Finance reported that the attacker created 2 million AUSD tokens without sufficient backing.

The attacker then used cross-chain transfers to move about 1.4 million AUSD, 105 Ether and 1.08 million USD Coin to Ethereum, according to D2 Finance. The assets were later consolidated into an Ethereum wallet holding about 1,135.5 Ether, valued at approximately $2.73 million at the time of the report.

D2 Finance linked the incident to a vulnerability in a function written in the Move programming language. The flaw allegedly allowed the attacker to create unbacked tokens and exchange them for assets held on Ethereum.

Initia has not confirmed the estimated losses or the precise cause of the exploit. The project has not provided a timeline for restoring its blockchain and rollups, and the effect on users remains unclear.

Initia’s native INIT token briefly fell to about $0.115 on Oct. 23 before recovering above $0.15, according to CoinGecko data. It was trading near $0.1496 at the time of the report, up about 14% over 24 hours.

Initia is a layer-1 blockchain designed to support interconnected rollups called Minitias. Its architecture allows assets to move between Initia, its rollups and other blockchains, including Ethereum.