The Initia hack forced the layer-1 blockchain to halt its entire network and connected rollups on Friday after security researchers flagged an exploit that let an attacker create tokens without permission and steal more than $2.6 million in crypto assets.

Initia said it stopped the network at 3:41 p.m. UTC on Friday in response to a security incident, adding that the team was coordinating with security researchers, validators and exchanges to work out how far the impact extends.

The shutdown matters because Initia operates a base chain alongside application-specific rollups, so the suspension cut off activity across the broader network rather than a single application. The project has yet to verify the loss estimates or identify exactly what caused the exploit, and the timeline for restoring operations remains unclear.

How the Initia hack unfolded

Security researcher Spreek was the first to raise the alarm on Friday, saying an attacker had created tokens without authorization and swapped roughly $2.6 million into other assets, while more funds continued to move.

D2 Finance, a DeFi platform, later said the attacker abused a vulnerability to create 2 million AUSD tokens lacking sufficient backing, then moved approximately 1.4 million AUSD, 105 Ether and 1.08 million USDC to Ethereum through cross-chain transfers.

According to a Cointelegraph report on October 24, Initia took down every rollup network linked to its layer-1 mainnet right after the security incident. Shutting down the base chain together with its rollups was meant to keep the incident contained as investigators probed the flaw and worked with network participants.

The loss figures come from outside observers and are estimates, not a final assessment from Initia itself. Initia confirmed the operational shutdown, while the researcher provided the estimate of assets moved and the claim of unauthorized minting.

Suspected zero-day in MoveVM

Early findings attributed to Ezaan Mangalji, Initia's co-founder who goes by Zon, suggested a previously unknown flaw in the network's MoveVM implementation running on the Cosmos SDK.

Agora, which issues the AUSD stablecoin, pushed back on the claim that the unauthorized minting was tied to its own systems on Initia. The company said it has no smart contracts deployed on the network and that the incident involved a third-party product using AUSD, adding that its freeze response would be limited to chains where AUSD contracts are deployed.

Initia had not publicly established the complete technical cause or confirmed the full scope of the exploit. The Block reported that the attacker minted and bridged out AUSD, ETH and USDC valued at roughly $2.7 million before the chain was paused, and Initia had yet to verify the amount lost.

INIT token drops, then rebounds

INIT, the network's native token, fell to roughly $0.115 in the immediate aftermath of the incident and later recovered to trade above $0.15, while South Korean exchange Upbit posted an investor caution notice on the token.

TradingView reported that INIT was changing hands near $0.1496, up about 14% over the prior 24 hours. Initia warned users to be careful with unofficial links, messages and claims spreading during the investigation, noting that both the base blockchain and its rollups had stopped.

Initia's backers and architecture

Initia is built as a layer-1 blockchain supporting interconnected rollups called Minitias, with its pitch centered on interwoven rollups built on the Cosmos SDK and supporting both MoveVM and EVM environments.

In February 2024, the startup raised $7.5 million in seed financing co-led by Delphi Ventures and Hack VC, saying then that the funds would go toward its testnet, planned for the first quarter of 2024. By July 2024, LayerZero Labs and Initia Labs had announced plans to develop an interoperability standard for Cosmos.

In November 2024, lending protocol Echelon announced a Move appchain built on Initia's Interwoven Stack and Celestia's modular blockchain technology, saying the chain would enable atomic cross-chain composability with Initia's layer-1 and a native liquidity hub. Its public testnet was scheduled for later in 2024, with the mainnet launch aligned with Initia's rollout.

Initia's mainnet launched in 2025 along with its native token, INIT, which has a total supply of 1 billion. The project previously ran into a configuration error involving INIT staking rewards, which was not an exploit and was resolved in 2025 through governance actions.

What comes next after the Initia hack

Initia's next steps include determining the vulnerability's root cause, establishing the full extent of the affected assets, and coordinating with validators and exchanges. The team said it was working with security researchers, validators and exchanges to investigate the incident and assess its impact.

Cointelegraph was unable to contact Initia for additional comment through its official X account. How the team explains the vulnerability will determine how serious the flaw was, and with assets reportedly still in transit at the time of the initial reports, the approximately $2.6 million figure may not be final.

Conclusion

The Initia hack left the layer-1 network and its rollups frozen after an attacker minted unbacked tokens and moved roughly $2.6 million to Ethereum, according to researcher estimates that Initia has yet to confirm. The team has not disclosed the root cause, the full scope of losses or a restart schedule.

The next concrete step is Initia's technical investigation, conducted with security researchers, validators and exchanges, which is expected to establish the vulnerability's cause and the full extent of affected assets before operations resume.

Frequently Asked Questions

How much was stolen in the Initia hack?

Security researcher Spreek estimated that approximately $2.6 million was cashed out, with more funds still moving at the time of the initial reports. D2 Finance said the attacker withdrew about 1.4 million AUSD, 105 Ether and 1.08 million USDC to Ethereum. Initia has not confirmed a final loss figure.

When did Initia halt its network and rollups?

Initia said the network was halted at 3:41 p.m. UTC on Friday, October 23, following a security incident. The suspension covered both the layer-1 base chain and all connected rollups, and the team gave no schedule for restarting operations.

What caused the Initia exploit?

Preliminary findings attributed to co-founder Ezaan Mangalji pointed to a previously unknown vulnerability in the network's MoveVM implementation on the Cosmos SDK that allowed unauthorized token minting. Initia has not publicly established the complete technical cause.

How did the INIT token price react to the hack?

INIT plunged to about $0.115 immediately after the incident before rebounding above $0.15, and TradingView reported it trading near $0.1496, up roughly 14% over the previous 24 hours. South Korean exchange Upbit posted an investor caution notice on the token.

What is Agora's role in the AUSD minting dispute?

Agora, the issuer associated with AUSD, disputed the account linking the unauthorized minting to its infrastructure, saying it has no smart contracts deployed on Initia and that the incident involved a third-party product using AUSD. It said any freeze response would be limited to chains where its contracts are deployed.