Million

Initia

Token

AUSD

Initia has <a href="https://x.com/initia/status/2113661738625155217" rel="noopener noreferrer nofollow">halted its Layer 1 blockchain and connected rollups</a> after an attacker exploited a previously unknown software vulnerability to mint unauthorized tokens and withdraw approximately $2.7 million in cryptocurrency from cross-chain bridge reserves.
The network stopped processing transactions at 15:41:30 UTC on October 23, 2026, leaving users unable to transact across Initia’s interconnected blockchain infrastructure. The attacker had already moved AUSD, Ethereum (ETH) and USDC to Ethereum before validators coordinated the emergency shutdown.
Initia co-founder Ezaan Mangalji <a href="https://x.com/ItsAlwaysZonny/status/2113667290059190466" rel="noopener noreferrer nofollow">identified a previously unknown flaw</a> in the network’s Move Virtual Machine (MoveVM) implementation on Cosmos SDK. The vulnerability enabled unauthorized token creation on the base blockchain but did not allow the attacker to mint additional native INIT tokens.
<h2 id="attacker-minted-unbacked-tokens-and-drained-bridge-reserves">Attacker Minted Unbacked Tokens and Drained Bridge Reserves</h2>
The exploit began at approximately 14:59 UTC, when the attacker executed malicious transactions that generated unbacked representations of assets normally transferred into Initia through cross-chain bridges.
An <a href="https://bitquery.io/investigations/initia-hack" rel="noopener noreferrer nofollow">onchain investigation</a> by Bitquery traced approximately $7.48 million in unauthorized token creation at nominal face value, executed in four batches over 13 seconds. However, much of that amount consisted of synthetic iUSD that could not be redeemed at its stated value.
The attacker successfully extracted approximately $2.73 million in real assets from bridge reserves backing AUSD, ETH and USDC on Initia.
The withdrawals exploited the relationship between tokens issued on Initia and their underlying assets held on other networks. Unauthorized balances could be burned through otherwise legitimate bridge transactions, releasing real cryptocurrency from the corresponding reserves.
Approximately 1.4 million AUSD and 105 ETH were released through Ethereum-side LayerZero adapters, while another 1.08 million USDC moved through Noble and Circle’s Cross-Chain Transfer Protocol (CCTP).
The stolen assets were subsequently converted into approximately 1,135.5 ETH and consolidated in an <a href="https://etherscan.io/address/0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8" rel="noopener noreferrer nofollow">Ethereum wallet</a>.
The incident follows the recent <a href="https://cryptoadventure.com/cysic-halts-bridge-after-10-million-cys-exploit-sends-727k-to-ethereum/" rel="noopener noreferrer nofollow">Cysic bridge exploit</a>, where an attacker minted 10 million unauthorized CYS tokens and transferred approximately $727,000 in proceeds to Ethereum.
<h2 id="usdc-reserve-nearly-emptied-as-agora-responds">USDC Reserve Nearly Emptied as Agora Responds</h2>
The attack significantly reduced liquidity backing bridged assets on Initia, creating immediate withdrawal problems for legitimate users.
Noble’s USDC reserve, which initially held approximately $1.09 million, fell to just $63 during the incident and subsequent withdrawals. The depleted balance prevented further redemptions, with 55 unsuccessful withdrawal attempts recorded before the network halt, many involving repeated requests from the same trading bot.
The Ethereum-side ETH reserve lost approximately 96% of its holdings, while the AUSD adapter was depleted by roughly 71%.
Similar reserve vulnerabilities previously affected the <a href="https://cryptoadventure.com/liquid-network-pauses-after-320m-bitcoin-peg-out-drains-most-reserves/" rel="noopener noreferrer nofollow">Liquid Network</a>, which suspended operations in September after nearly 4,000 BTC left its federation wallet through an unauthorized peg-out.
Agora, the issuer of AUSD, <a href="https://x.com/withAUSD/status/2113681155585368432" rel="noopener noreferrer nofollow">confirmed that its own stablecoin infrastructure was unaffected</a>. The company has no native AUSD contracts deployed on Initia, and its existing stablecoin reserves remain fully backed.
Agora also committed to freezing attacker-linked AUSD balances on supported networks. However, the stolen AUSD had already been converted into ETH before that intervention, and no completed freeze of those proceeds has been established.
<h2 id="exchanges-suspend-init-transfers-as-investigation-continues">Exchanges Suspend INIT Transfers as Investigation Continues</h2>
South Korean exchange Upbit temporarily suspended INIT deposits and withdrawals following the security incident and issued a trading caution notice. Spot trading was not suspended as part of that initial action.
KuCoin also <a href="https://www.kucoin.com/announcement/en-kucoin-has-temporarily-closed-the-deposit-and-withdrawal-services-of-initia-init-1" rel="noopener noreferrer nofollow">suspended INIT deposits and withdrawals</a> on October 24, citing essential network maintenance.
Initia is working with security specialists, validators and cryptocurrency exchanges to determine the full scope of the vulnerability and assess losses across the affected bridges.
The investigation has not established a final financial loss, a complete technical root cause or a compensation arrangement for affected users. No patch release or confirmed network restart date has been announced.
Initia has warned users to avoid unofficial recovery links and suspicious messages while the <a href="https://cryptoadventure.com/top-layer-1-blockchain-projects-to-watch/" rel="noopener noreferrer nofollow">Layer 1 blockchain</a> and connected rollups remain suspended.
The post <a href="https://cryptoadventure.com/initia-halts-network-after-2-7-million-movevm-token-minting-exploit/" rel="noopener noreferrer nofollow">Initia Halts Network After $2.7 Million MoveVM Token Minting Exploit</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Initia Halts Network After $2.7 Million MoveVM Token Minting Exploit

Table of Contents

Crypto Adventure

Other articles published on Oct 24, 2026

Join our free newsletter for daily crypto updates!