By Initia halted its Layer 1 blockchain and connected rollups on October 23 after a security incident allowed an attacker to mint tokens without authorization and move approximately $2.7 million worth of assets out before the network was stopped.
Initia co-founder Ezaan Mangalji said preliminary findings point to a previously unknown bug in the network’s MoveVM implementation on the Cosmos SDK. The vulnerability allowed unauthorized token minting but did not apply to INIT, the blockchain’s native token.
Mangalji said the attacker was able to mint and bridge out roughly $2.7 million worth of AUSD, ETH and USDC before the chain was paused. That figure should not yet be treated as Initia’s confirmed final loss because the project is still determining the full impact of the incident.
Initia said it was working with security teams, validators and exchanges to establish the scope of the breach.
How Did the Initia Minting Exploit Work?
The preliminary technical explanation centers on MoveVM, the virtual-machine environment used by parts of the Initia ecosystem. Mangalji described the vulnerability as a previously unknown bug in Initia’s implementation of MoveVM on the Cosmos SDK.
The critical issue is that the attacker could apparently create assets without the normal authorization that should precede their issuance. If those newly created assets can then be bridged or exchanged for legitimately backed assets, an unauthorized mint becomes an economic extraction rather than simply an accounting problem.
That distinction has appeared in other recent cross-chain incidents. In October, Cysic suspended its bridge after an attacker minted 10 million CYS without authorization. In that case, the amount created was not equivalent to the attacker’s realized proceeds because some tokens remained traceable or restricted.
The same principle applies to Initia. The amount that could theoretically have been created, the amount bridged out and the final economic loss are separate figures. Initia has so far provided an estimate for assets moved out but not a completed loss reconciliation.
Investor Takeaway
The key figure is not how many tokens could be minted, but how much real liquidity the attacker successfully extracted before the network halt.
Why Did Initia Halt Both Its L1 and Rollups?
Stopping the network limits an attacker’s ability to continue exploiting the affected execution path or transfer additional assets while developers investigate. But a full blockchain halt also affects legitimate users and applications that depend on the same infrastructure.
Initia’s architecture links its Layer 1 with application-specific rollups. Pausing both therefore represents a wider containment measure than disabling a single application or bridge contract.
Blockchain shutdowns have increasingly become an emergency response when exploits threaten losses beyond one protocol. In August, Cronos validators halted the blockchain during the Tectonic exploit, preventing most suspected exploit-linked assets from leaving the network while also stopping unrelated transactions.
For Initia, the effectiveness of the halt will depend on how much value had already crossed into external networks and whether additional unauthorized assets remain inside the ecosystem.
Does the Incident Affect the INIT Token Supply?
According to Initia’s preliminary findings, the vulnerability does not apply to native INIT tokens. That is an important distinction because the incident therefore does not currently establish that attackers created additional INIT supply.
INIT nevertheless experienced sharp volatility after the security incident became public. The token initially dropped about 14% before recovering the decline and trading roughly 14% higher on the day at the time of the initial incident update.
The reversal does not resolve the underlying security issue. Investors still need confirmation of which assets were minted, how much unauthorized value remains on Initia, whether bridge reserves or liquidity providers absorbed losses and what technical changes will be required before operations resume.
Investor Takeaway
Native INIT supply is not currently identified as compromised, but unresolved bridge liabilities and network downtime remain material risks until Initia completes its accounting.
What Must Initia Establish Before Restarting?
The next disclosure needs to go beyond an initial exploit estimate. Initia will need to identify the vulnerable code path, determine exactly which assets were created without authorization and reconcile them against assets that successfully left the network.
That accounting can materially change an early loss estimate. FinanceFeeds previously reported that Symbiosis recovered 15 Bitcoin after a bridge exploit while questions remained over how recovered assets related to the attacker’s realized proceeds.
Initia also needs to explain whether the flaw has been fully patched, whether validators must deploy an upgrade and what safeguards will prevent the same minting path from being used again. A restart timetable alone would not answer those questions.
Until that work is complete, approximately $2.7 million is best treated as the amount Initia’s co-founder says the attacker minted and bridged out before the halt, rather than a final confirmed loss. The project’s eventual incident report will need to reconcile the unauthorized issuance, bridged assets and any recoverable funds before the financial impact can be established.