Agora

Initia

AUSD

Token

<p><strong>A hacker exploited a previously unknown bug in Initia's blockchain infrastructure on October 23, 2026, minting and bridging out roughly $2.7 million in digital assets before the network's validators halted the chain entirely, freezing all transactions across its L1 and connected rollups.</strong></p>
<h2 id="how-the-reported-initia-incident-unfolded">How the Reported Initia Incident Unfolded</h2>
<p>Initia's official account confirmed that, as of 3:41:30 PM UTC on October 23, its <a href="https://x.com/initia/status/2113661738625155217" rel="noopener noreferrer nofollow">L1 and rollups had been halted</a> in response to a security incident. The pause was a deliberate defensive measure, not a network crash, and it stopped all on-chain activity while the team investigated the scope of the breach. For related coverage, see <a href="https://www.nftenex.com/fed-experiment-bitcoin-rallies-new-crypto-buyers/" rel="noopener noreferrer nofollow">Fed Experiment Shows Bitcoin Rallies Attract New Crypto Buyers</a>.</p>
<h3 id="the-reported-2-7-million-minting-event">The Reported $2.7 Million Minting Event</h3>
<p>Co-founder Ezaan Mangalji attributed the incident to a Day 0 bug in Initia's MoveVM implementation on CosmosSDK. According to Mangalji, the flaw allowed the attacker to mint additional tokens directly on the Initia L1, sidestepping normal issuance controls entirely. For related coverage, see <a href="https://www.nftenex.com/bitcoin-price-85000-resistance-range-highs-explained/" rel="noopener noreferrer nofollow">Bitcoin Near Range Highs: Why $85,000 Is the Key Ceiling</a>.</p>
<blockquote class="twitter-tweet" style="margin:20px 0;padding:16px 18px;background:#1a0d17;color:#f3f4f6;border:1px solid #e040fb;border-radius:12px;margin:20px 0;padding:16px 18px;background:#1a0d17;color:#f3f4f6;border:1px solid #e040fb;border-radius:12px">
 <p>to the best of our knowledge so far, this is a Day 0 bug related to Initia's MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens.<br><br>the attacker was able to mint and bridge out ~$2.7m worth of AUSD,… <a rel="noopener noreferrer nofollow" href="https://t.co/bHh6FdirVu">https://t.co/bHh6FdirVu</a> For related coverage, see <a href="https://www.nftenex.com/future-leaders-awards-conference-2026-to-bring-global-business-and-technology-leaders-to-singapore-on-2-3-november/" rel="noopener noreferrer nofollow">Future Leaders Awards &amp;amp; Conference 2026 to Bring Global Business and Technology Leaders to Singapore on 2–3 November</a>.</p>— zon 🪢 (@ItsAlwaysZonny) <a rel="noopener noreferrer nofollow" href="https://x.com/ItsAlwaysZonny/status/2113667290059190466?ref_src=twsrc%5Etfw">October 23, 2026</a>
</blockquote>
<p>Mangalji said the attacker <a href="https://x.com/ItsAlwaysZonny/status/2113667290059190466" rel="noopener noreferrer nofollow">minted and bridged out approximately $2.7 million</a> in AUSD, ETH, and USDC before the chain was paused. The funds left the Initia ecosystem via bridging infrastructure, meaning the attacker had already moved assets to other networks by the time the halt took effect.</p>
<figure style="margin:24px 0;padding:20px 22px;border:1px solid #f0b7b7;border-left:5px solid #c62828;border-radius:8px;background:#fff8f8;font-family:Arial,Helvetica,sans-serif">
 <div style="font-size:12px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;color:#8f1d1d;margin:0 0 8px">
  Reported exploit exposure
 </div>
 <div style="font-size:42px;line-height:1;font-weight:800;color:#1c1c1c;margin:0 0 10px">
  ~$2.7M
 </div>
 <figcaption style="font-size:14px;line-height:1.45;color:#454545;margin:0">
  The amount reportedly minted and bridged before Initia paused its chain; it is an early estimate, not a final reconciled loss figure.
 </figcaption>
</figure>
<p>Importantly, Mangalji stressed that native INIT tokens were not affected by the described bug. The vulnerability was specific to the MoveVM module's token minting logic, not to the chain's base-layer asset. The final scope, total loss figure, and definitive root cause remain under active investigation, according to the team's initial statement.</p>
<h3 id="the-chain-halt-and-immediate-status">The Chain Halt and Immediate Status</h3>
<p>When Initia's L1 went dark, every rollup built on top of it followed. The halt interrupted transaction processing across the entire Initia ecosystem, affecting any application, bridge, or user with pending activity at the time. <a href="https://news.bitcoin.com/security/hacker-prints-2-7m-in-crypto-as-initia-blockchain-grinds-to-a-halt/" rel="noopener noreferrer nofollow">The chain remained halted</a> when secondary reporting was published. South Korean exchange Upbit also suspended INIT deposits and withdrawals following the incident, reflecting the standard exchange response to a live chain-security event.</p>
<p>This kind of coordinated halt is a legitimate crisis-management tool for Cosmos-based chains, where validators can reach social consensus to stop block production. It prevents further exploit transactions but also means legitimate users cannot move funds until the chain restarts under a patched binary.</p>
<h2 id="what-the-halt-means-for-initia-users-and-the-response">What the Halt Means for Initia Users and the Response</h2>
<h3 id="practical-effects-on-token-holders-and-applications">Practical Effects on Token Holders and Applications</h3>
<p>Any transaction submitted to the Initia L1 during the halt window is effectively suspended. Applications relying on Initia's rollup infrastructure, including any projects using AUSD as a stablecoin layer, could not process user actions while the chain was paused. Stablecoin issuer Agora moved quickly to contain cross-chain exposure. The company said it has no smart contracts deployed on Initia itself, and its security team committed to freezing funds linked to hacker addresses that hold AUSD on chains where Agora's smart contracts are deployed.</p>
<blockquote class="twitter-tweet" style="margin:20px 0;padding:16px 18px;background:#1a0d17;color:#f3f4f6;border:1px solid #e040fb;border-radius:12px;margin:20px 0;padding:16px 18px;background:#1a0d17;color:#f3f4f6;border:1px solid #e040fb;border-radius:12px">
 <p>We're aware of today's security incident on Initia. Agora has no smart contracts deployed on Initia. Our security team has been monitoring the situation and will freeze funds related to hacker addresses that hold AUSD on chains where AUSD/Agora smart contracts are deployed.</p>— Agora (@withAUSD) <a rel="noopener noreferrer nofollow" href="https://x.com/withAUSD/status/2113676134676406456?ref_src=twsrc%5Etfw">October 23, 2026</a>
</blockquote>
<p>Agora's response highlights how cross-chain asset issuers can act as a secondary defense layer when a host chain is compromised. By blacklisting attacker addresses at the contract level on other networks, the issuer can effectively strand funds that have already bridged out, reducing the attacker's ability to liquidate stolen assets. This dynamic is a meaningful feature of programmable stablecoin infrastructure that pure on-chain attackers often underestimate.</p>
<h3 id="init-token-market-response">INIT Token Market Response</h3>
<p>Because the bug targeted non-native assets, INIT token holders faced a different risk profile than the direct victims of the minting exploit. At the time of the research snapshot, <a href="https://www.coingecko.com/en/coins/initia" rel="noopener noreferrer nofollow">INIT was priced at $0.132268</a>, down 1.83% over 24 hours, with approximately $33.45 million in 24-hour trading volume against a market capitalization of roughly $27.9 million. The 24-hour volume figure exceeding the total market cap indicates unusually elevated turnover, consistent with a security-event sell-off and reactive trading rather than ordinary liquidity patterns.</p>
<figure style="margin:24px 0;padding:20px 22px;border:1px solid #b9d8ed;border-left:5px solid #1976a8;border-radius:8px;background:#f5fbff;font-family:Arial,Helvetica,sans-serif">
 <div style="font-size:12px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;color:#155b82;margin:0 0 8px">
  INIT price at research capture
 </div>
 <div style="font-size:42px;line-height:1;font-weight:800;color:#1c1c1c;margin:0 0 10px">
  $0.132268
 </div>
 <div style="font-size:16px;font-weight:700;color:#a52b2b;margin:0 0 8px">
  −1.83% over 24 hours
 </div>
 <figcaption style="font-size:14px;line-height:1.45;color:#454545;margin:0">
  Snapshot data also showed roughly $33.45 million in 24-hour trading volume. This native-token market reading should not be treated as a measure of the reported non-native asset exposure.
 </figcaption>
</figure>
<p>The broader <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">Crypto Fear &amp; Greed Index</a> stood at 51 (Neutral) at the time of the snapshot, suggesting the incident had not yet produced a market-wide fear response beyond Initia's own token activity.</p>
<h3 id="response-milestones-to-watch">Response Milestones to Watch</h3>
<p>Initia said it was working with security teams, validators, and exchanges to investigate the full scope of the incident. The key milestones ahead include: a confirmed root cause and patch, a coordinated validator upgrade to the patched binary, a supervised chain restart, and a post-incident report reconciling the $2.7 million figure against on-chain evidence. Until an official post-mortem is published, the $2.7 million figure should be treated as an early estimate rather than a final loss number.</p>
<p>Incidents of this type, where a bridge-enabled chain exploit enables rapid asset extraction before a halt, have become a recurring pattern in Cosmos-based infrastructure. A <a href="https://www.nftenex.com/coldcard-hacker-uses-thorchain-to-swap-stolen-btc/" rel="noopener noreferrer nofollow">similar cross-chain movement pattern</a> was documented in the Coldcard/THORChain incident, where an attacker used interoperability infrastructure to convert stolen assets before responders could react. The speed of bridging is a structural challenge that no single protocol can solve unilaterally.</p>
<p>Users and builders with active positions or deployments on Initia should rely exclusively on official announcements from the Initia team before taking any action. Phishing attempts and fake recovery schemes routinely follow high-profile chain halts; treat any unsolicited link or wallet-connection request related to this incident as malicious until verified through Initia's own communication channels. Developers building on Initia's rollup stack or using AUSD as a settlement layer should monitor Agora's official channels for updates on address blacklisting and contract-level protections, similar to what <a href="https://www.nftenex.com/grayscale-token-for-shares-swaps-crypto-etfs-trusts/" rel="noopener noreferrer nofollow">institutional operators managing multi-asset crypto positions</a> routinely track during security events affecting underlying infrastructure.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.nftenex.com/?p=11459" rel="noopener noreferrer nofollow">Read original article on nftenex.com</a>

Hacker Prints $2.7M in Crypto as Initia Blockchain Halts

Table of Contents

NFTENEX

Other articles published on Oct 24, 2026

Join our free newsletter for daily crypto updates!