Agora

Initia

AUSD

Ethereum

On Friday, an address tied to the Initia exploit sent about 1,135 ETH, worth more than $2.7 million, to a second Ethereum wallet.Initia halted both its Layer 1 and all its rollups at 15:41:30 UTC, five seconds before the transfer got settled.
Spreek, the onchain analyst, raised the alarm at 15:27 UTC. “Initia chain hacked and a bunch of tokens infiniminted. Hacker has cashed out $2.6m thus far with more in flight,” he <a href="https://x.com/spreekaway/status/2113653520981447144" rel="noopener noreferrer nofollow">wrote</a>.
<h3 id="span-style-font-weight-400-agora-froze-the-exploit-address-after-1-4-million-ausd-left-span">Agora froze the exploit address after 1.4 million AUSD left</h3>
Prior to the massive transfer, the same address exchanged 1.4 million AUSD and about 1 million USDC into ETH via 1inch. Both <a href="https://etherscan.io/tx/0xeb5e85e76f00a7a84dfe4d2d6aab146a769785b3d80307c67dde14c79f36c5ae" rel="noopener noreferrer nofollow">swaps</a> happened between 15:03 and 15:05 UTC, more than 20 minutes before the first public alert.
Spreek said the attacker created bridgeable tokens on Initia without backing and bridged them back out, draining the bridge contract. “effectively means the AUSD and similar is unbacked on initia right now,” he <a href="https://x.com/spreekaway/status/2113656826512232880" rel="noopener noreferrer nofollow">said</a>.
At 18:04 UTC, the receiving <a href="https://etherscan.io/address/0x358eF0130f7A5aA516dCd81Bdc80B18CdE41CAC8" rel="noopener noreferrer nofollow">wallet</a> still had the 1,135.5 ETH in it, and no outgoing transaction was registered. And the AUSD issuer Agora froze the attacker’s first address on Ethereum at 16:31:59 UTC.
The freeze came about after the swaps, and the address already had zero AUSD. Agora also <a href="https://x.com/withAUSD/status/2113676134676406456" rel="noopener noreferrer nofollow">said</a> it “has no smart contracts deployed on Initia,” so its freeze only affects chains where AUSD contracts are deployed.
<h3 id="span-style-font-weight-400-upbit-suspends-init-deposits-and-withdrawals-pending-checks-span">Upbit suspends INIT deposits and withdrawals pending checks</h3>
“As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident,” Initia said on X. Initia is working with security professionals and exchanges to figure out how bad the damage is.
<figure style="width: 100%" class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/10/2026-10-23-initia-attacker-moves-1135-eth-chain-halts-01.png" alt="Initia attacker moves 1,135 ETH as chain halts." width="621" height="432">
 <figcaption>
 Initia’s halt notice, posted by @initia on <a href="https://x.com/initia/status/2113661738625155217" rel="noopener noreferrer nofollow">X</a> on October 23, 2026.
 </figcaption>
</figure>
Co-founder Ezaan <a href="https://x.com/ItsAlwaysZonny/status/2113667290059190466" rel="noopener noreferrer nofollow">Mangalji</a> believes a newly discovered software flaw let the hacker create tokens and take out about $2.7 million. Initia’s server showed the last block, 23,365,925, was made at the moment of the shutdown.
The base chain manages bridging and liquidity for all Initia rollups. When it was stopped, transfers and trading on InitiaDEX froze for all users including the INIT holders.
Upbit said in its <a href="https://upbit.com/service_center/notice?id=6698" rel="noopener noreferrer nofollow">notice</a> that it halted INIT deposits and withdrawals at 15:57 UTC, citing signs of the security incident on the network. Trading continues, and the exchange said it would resume transfers only once it was convinced deposits and withdrawals were stable.
INIT sank 14% at the time of exploit disclosure. The token then reversed the losses and was trading about 14% higher on the day as of 17:03 UTC.
On October 17, a Cysic attacker forged a mint message and withdrew 10 million unauthorized CYS from the bridge, according to <a href="https://www.cryptopolitan.com/cysic-attacker-sold-7-2m-cys-before-freeze/" rel="noopener noreferrer nofollow">Cryptopolitan</a>. In August, <a href="https://www.cryptopolitan.com/harmony-one-sinks-40-apparent-4b-token-mint/" rel="noopener noreferrer nofollow">Cryptopolitan</a> reported on what appeared to be a 4 billion ONE mint on Harmony.
If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.

Initia exploiter shifts over $2.7 million in ETH seconds after network halt

Table of Contents

Cryptopolitan_News

Other articles published on Oct 23, 2026

Join our free newsletter for daily crypto updates!