Initia

Initia is in the news because it stopped its chain on 23 October after a token-minting exploit, which co-founder Ezaan Mangalji put at about $2.7 million. The attack itself took minutes: one transaction minted 2 million unbacked tokens representing AUSD on Initia, and assets had reached Ethereum within seven minutes and 21 seconds of the mint, TokenPost reports. The chain was still halted as of 26 October, according to TokenPost.

What happened

Initia said on 23 October that as of 15:41:30 UTC its layer-1 and rollups had been halted "due to a security incident", that it was working with security teams, validators and exchanges to establish the scope of any impact, and that it would share verified information through its official channels. The same post asked users to be careful of unofficial links, messages and claims circulating during the incident.

The mint came at 10:59 a.m. ET, or 14:59 UTC, and within minutes about 1.4 million AUSD and 105 ETH had been bridged out to Ethereum, along with 1.08 million USDC through Circle's CCTP, TokenPost reports. That was more than 40 minutes before the 15:41 UTC halt reported by Cointelegraph.

Cointelegraph described the same path: an exploit in a Move function let the attacker create unbacked tokens, swap them for assets on Ethereum, and withdraw roughly 1.4 million AUSD, 105 ETH and 1.08 million USDC, later consolidated into an Ethereum wallet holding about 1,135.5 ETH, worth $2.73 million. Researcher Spreek estimated about $2.6 million had been cashed out, and at the time of Cointelegraph's report Initia had not confirmed the loss or the cause. CryptoBriefing called it an infinite-mint exploit and put the amount converted at about $2.6 million at the time of writing, with more possibly still in transit. The Defiant reported Spreek's estimate and an Ethereum record of stablecoin swaps followed by a later 1,135.5 ETH transfer.

Initia has since said more. Mangalji called it "a Day 0 bug related to Initia's MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens", and said the attacker "was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused", Bitcoin.com reports. On 24 October Initia attributed the attack to a caching vulnerability in MoveVM scripts that let the attacker bypass security checks and forge MoveVM state, ChainCatcher reports.

The estimates span about $130,000: about $2.6 million cashed out on Spreek's figure, about $2.7 million on Mangalji's, and $2.73 million for the 1,135.5 ETH wallet.

Who carries the loss

Agora, which issues AUSD, says the tokens minted on Initia were not its own. "AUSD does not exist on Initia," Agora said, adding that AUSD and Agora are unaffected and that AUSD is fully backed, according to Bitcoin.com. The Defiant reported Agora's position that the exploit hit a third-party product using AUSD, that Agora has no smart contracts deployed on Initia, and that Ethereum records show 1.4 million AUSD leaving a bridge adapter.

Why it matters

Initia is a modular layer-1 built on the Cosmos SDK that supports both MoveVM and EVM execution, with mainnet launched in 2025. CryptoBriefing reports those details along with a total INIT supply of 1 billion, about $24 million raised from investors including Binance Labs and Delphi Digital, several security audits, and an earlier INIT staking-rewards configuration error that was resolved through governance in 2025.

The mechanics of the exploit matter more than the headline figure. Value left the chain through a bridge within minutes, so a rollback on Initia would erase the mints but not the releases, as D2 Finance put it. Cointelegraph reported that INIT briefly fell to around $0.115 before rebounding above $0.15. On 26 October Upbit placed INIT under trading caution, with deposits and withdrawals suspended, TokenPost reports.

What to watch

The restart. Initia said on 24 October that its security fix is expected to be completed and audited within a few days, that a complete post-mortem will follow, and that asset recovery is being pursued with security partners, according to ChainCatcher. No restart date had been announced as of 26 October, TokenPost reports. The open question for users is whether the bridged AUSD, ETH and USDC on Initia are made whole, which D2 Finance has asked in public.