Initia Halted Its Whole Network After a $2.7 Million Token Mint. Here's How the Money Left

At 15:41:30 UTC on Friday 23 October, Initia stopped producing blocks. The halt covered the layer 1 chain and every rollup built on top of it, which means an entire network of applications went dark in the space of a single block.

Fourteen minutes earlier, an on-chain researcher had posted that the chain was being drained. By the time the pause took effect, roughly $2.6 million to $2.7 million in real assets had already left for Ethereum.

As of Saturday morning, Initia was still offline. The project has not published a post-mortem, has not confirmed a loss figure, and has not said when the chain will come back.

What happened, in order

The clearest reconstruction comes from D2 Finance, a DeFi platform that traced the transactions and published a breakdown.

At 14:59:26 UTC, a single transaction created 2,000,000 units of a bridged version of Agora's AUSD stablecoin on Initia. Those tokens had no backing behind them.

The attacker then burned them and sent a bridge message to Ethereum. LayerZero's OFT adapter for that asset, a lockbox contract holding the real tokens that back the bridged copies, released what it was holding: about 1.4 million AUSD, or 71% of the adapter's balance, plus 105 ETH, or 96% of the native ETH adapter.

A further 1.08 million USDC was minted on Ethereum through Circle's Cross-Chain Transfer Protocol. According to D2's timeline, $2.65 million had reached Ethereum seven minutes and 21 seconds after the initial mint.

At 15:27 UTC, researcher Spreek flagged the attack publicly, reporting that tokens had been minted without limit and that about $2.6 million had been cashed out. Initia halted the network at 15:41:30 UTC. The last block on the base chain was 23,365,925.

The 1.4 million AUSD sat in the attacker's Ethereum address for about 84 seconds before being swapped on the 1inch aggregator. Agora froze that address at 16:31 UTC, roughly 89 minutes after the funds arrived and by which point it held no AUSD. At the same minute the halt took effect, 1,135.5 ETH moved to a freshly used wallet.

The bug sat in Initia's own code

Initia's co-founder Ezaan Mangalji, who goes by Zon, described the preliminary finding as a "Day 0" bug related to Initia's MoveVM implementation on the Cosmos SDK. In his account it allowed the exploiter to mint additional tokens on the Initia L1, and "does not apply to native INIT tokens." The phrase Day 0 matters: it points to a flaw present since the beginning, not something introduced by a recent upgrade.

Initia is built as one Cosmos SDK base chain that coordinates a mesh of application rollups called Minitias. Builders can run those rollups on MoveVM, EVM or WasmVM. The bug appears to sit in the MoveVM path on the base layer, which is the piece every rollup depends on.

D2 Finance attributed the exploit to a vulnerability in a Move function that let the attacker create unbacked tokens and exchange them for assets on Ethereum. Initia itself has confirmed neither the cause nor the amount.

Why the bridge paid out anyway

The mechanics here are the part worth understanding, because they will outlast this incident.

A bridged token is an IOU. The real asset sits locked in a contract on the home chain, and the copy circulates elsewhere. Burn the copy, send a valid message, and the lockbox releases the original. The adapter verifying that message can check that tokens were burned. It cannot check whether those tokens were ever backed by anything in the first place.

That is exactly what D2 pointed out: "an OFT adapter cannot check whether burned tokens were ever backed."

So a minting bug on a comparatively small chain turned into a loss of Ethereum-native assets. The USDC leg worked differently: Circle's CCTP mints native USDC against its own reserves rather than unlocking a lockbox, so that portion came out of the issuer's float rather than a pool on Ethereum.

By the accounts published so far, the immediate hole sits with whoever supplied the collateral in those adapters, not with Initia's treasury.

Agora says AUSD itself is untouched

Agora, which issues AUSD, moved quickly to separate its stablecoin from the incident. It said it has no smart contracts deployed on Initia, that "AUSD does not exist on Initia," and that AUSD remains fully backed across the networks where it is actually issued.

Those statements describe the token minted on Initia as a bridged representation rather than AUSD itself, which is consistent with D2's finding that the AUSD which left came from an Ethereum lockbox backing that representation.

That distinction is real, but it does not make the loss disappear. The stablecoin's reserves are intact; the collateral that stood behind the bridged version on Ethereum is not.

What nobody has answered yet

Several things remain genuinely unknown, and anyone trading around this story is working with incomplete information.

The size of the loss is still an estimate. Spreek put it near $2.6 million, Zon near $2.7 million, and Initia has confirmed neither. Whether that is a floor or a final figure is unresolved.

The code path has not been named. Initia has not said which module failed, whether it sat in audited code, whether it has been patched, or whether other deployments share it.

The restart is undefined. Initia has given no date and no block height, and has not said whether validators will resume from the block before the mint or roll the chain back. A rollback would rewind the unbacked tokens, but every rollup on the network would have to reconcile against a rewritten history.

It is also unclear which rollups were affected beyond the blanket reference to "rollups," whether users will be compensated, and whether any of the funds can be frozen or recovered.

If you hold assets on Initia

Nothing on the chain can move. Transfers, trades on native venues, staking, unstaking and bridging out are all frozen at the last block, and no transaction signed now will be processed.

INIT held on a centralised exchange is different, because it sits on the exchange's books rather than on the halted chain. Trading can continue, but deposits and withdrawals depend on the chain. Upbit suspended INIT deposits and withdrawals at 15:57 UTC and added a volatility caution notice shortly afterwards, and Kraken has paused INIT transfers. Reports that Bithumb did the same have not been confirmed by the exchange's own notice.

Initia has warned that verified information will come only through its official channels, and that warning is worth taking seriously. Halt events reliably produce fake refund portals, migration pages and "recovery" support accounts. There is no claim process right now.

The practical rule until the project publishes a fix is simple: do not bridge to or from Initia, and do not treat an exchange listing as proof that the underlying chain works.

Why a halt is the right call and a costly one

Stopping a chain is the emergency brake. It prevents further minting and further exits, and it also freezes every holder who had nothing to do with the attack.

That trade-off is sharper for Initia than for most networks. Its entire pitch is that one base layer ties many rollups together so assets and messages move without third-party bridges. The same design that removes bridge fragmentation also means one bug on the base layer reaches every Minitia at once, and one halt switches all of them off.

The incident does not invalidate that architecture. It does show what the concentration costs when the shared layer fails.

The market reaction is worth noticing

INIT fell about 14% when the exploit was reported, then reversed and finished the day roughly 14% higher, according to The Block. On CoinGecko data at 16:42 UTC it traded near $0.1375, up about 7.8% over 24 hours within a range of $0.1141 to $0.1491, with a market capitalisation around $28.9 million. Over 30 days the token was up about 66%.

A bounce on a halted chain tells you about order books, not about the fix. The token's price cannot yet price in a loss figure that has not been published, a code path that has not been identified, or a restart that has not been scheduled.

What to watch next

The post-mortem is the document that settles most of this. Where it locates the bug matters: a flaw in one application's contract is a contained incident, while a flaw in core minting or bridging logic is a much deeper problem for a network whose product is interconnection.

The restart mechanics matter just as much. Resuming from the current block leaves the unbacked mint in history. Rolling back to before it rewrites state across the whole network. Those are different outcomes for anyone holding a balance there.

After that, the questions are about money and trust: whether the adapter pools are recapitalised, whether affected users see anything back, and whether an audit or review explains how a bug present since launch survived this long.

Initia has promised verified updates through official channels. Until those arrive, the chain is down, the loss is an estimate, and the only reliable position is patience.