A security breach forced layer-1 blockchain Initia (INIT) to shut down its entire network on Friday, after an attacker exploited a flaw in its token-minting system to steal roughly $2.6 million in crypto assets.
Blockchain security researcher Spreek was the first to raise the alarm publicly, posting on X that an attacker had created tokens without authorization and had already converted close to $2.6 million into other assets, with more funds reportedly still in motion. He noted the figure was a preliminary estimate rather than a confirmed total.
Initia confirmed the incident shortly after through its own account on X, saying the Initia L1 chain and its rollups had been paused in response to a security incident. According to the company, the halt began at 3:41 pm UTC on Friday. The chain remained frozen at block height 23365925, with no timeline given for when normal operations might resume.
On the development, Initia said its team was coordinating with security researchers, validators and exchanges to assess the full scope of what happened, though the project stopped short of confirming a specific loss figure, naming any affected applications, or setting a restart date. “We will share verified information through our official channels as it becomes available,” the team wrote.
A clearer technical picture came later from DeFi platform D2 Finance, whose analysts found that the attacker had minted roughly 2 million AUSD tokens on Initia without any backing behind them. Using cross-chain bridges, those tokens were partly converted and transferred to Ethereum, moving about 1.4 million AUSD, 105 ETH and 1.08 million USDC across. The attacker then consolidated everything into one Ethereum wallet, which ended up holding around 1,135.5 ETH, worth approximately $2.73 million at the time, according to the firm.
Further, D2 Finance noted that the root cause was a vulnerability within a Move function, which let the attacker mint unbacked tokens and later swap them for real assets on Ethereum. The exploit transaction itself used 135,888 gas and called the Move function directly. Rather than defeating the bridge’s own security checks, the attacker found a separate opening in how the token-minting process worked.
Meanwhile, Initia co-founder Ezaan Mangalji, who goes by Zon online, offered an early theory behind the breach, saying preliminary findings suggested a previously unknown “Day 0” bug existed within the network’s MoveVM implementation on Cosmos SDK, one that enabled unauthorized token minting. He added that the issue “does not apply to native INIT tokens.”
