Initia Suspends Mainnet and Rollup Due to Security Incident
Initia announced on October 23, 2026, that as of 15:41:30 UTC, its L1 mainnet and rollup have been suspended due to a security incident. The team is collaborating with security teams, validators, and exchanges to investigate the extent of the impact and reminds users to be cautious of unofficial links and information.
On-chain security analyst Spreek stated that the Initia chain was attacked, resulting in unlimited token issuance. The hacker has cashed out approximately $2.6 million, with funds still being transferred. Co-founder Ezaan Mangalji (Zon) initially assessed that the vulnerability was an unknown "Day 0" flaw in the MoveVM implementation on the Cosmos SDK, allowing unauthorized minting, but it does not affect the native INIT token.
According to Zon, the attacker minted and cross-chain transferred approximately $2.7 million worth of AUSD, ETH, and USDC before the chain was suspended. D2 Finance analysis shows that the attacker minted 2 million AUSD and then extracted approximately 1.4 million AUSD, 105 ETH, and 1.08 million USDC to Ethereum, ultimately aggregating to about 1,135.5 ETH (approximately $2.73 million).
Both the Initia mainnet and interconnected rollup (Minitias) are currently halted. The native token INIT dropped by 14% after the news broke but later rebounded, ending the day with an increase of about 14%. The project team has not officially confirmed the final loss amount.
This incident is classified as a supply shock driven by a code defect. The attacker exchanged unbacked tokens for real assets through unlimited minting and then cashed out cross-chain; the beneficiaries are the addresses that successfully extracted and aggregated funds, while the burden falls on the related liquidity pools, cross-chain bridges locking assets, and users holding affected tokens. The chain has been suspended, further transfers are hindered, but some transfers already made are irreversible.
Source: Public Information
ABAB AI Insight
As a modular L1, Initia's design goal is to provide coordination and liquidity for interconnected rollups, having secured funding from Binance Labs among others after its mainnet launch. The project previously faced operational issues such as staking reward configuration errors. The exploitation of the MoveVM implementation flaw leading to unauthorized minting shows that its security boundaries at the cross-chain and virtual machine layers were still breached after launch.
In terms of capital flow, the attacker completed unlimited minting through a single transaction and then used cross-chain mechanisms like LayerZero to extract AUSD, ETH, and USDC to Ethereum and aggregate them. Funds flowed from Initia's liquidity and bridge-locked assets to the attacker's controlled address, with the time window shorter than the chain's suspension response. The project team is attempting to block further outflows by suspending the chain and collaborating with validators, but some extracted funds have already been transferred.
Similar cases include minting or bridging vulnerabilities that have occurred on other modular or Cosmos-based chains, where attackers quickly extracted real assets by exploiting flaws in virtual machine or cross-chain message validation. Initia is currently in the mainnet operation phase, and the security incident has directly frozen its functionality as a rollup coordination layer, forcing ecosystem applications and liquidity to pause.
Essentially, this is a case of technical substitution. The ability for unauthorized minting replaced the normal issuance mechanism, allowing attackers to convert virtual supply into extractable real assets in a short time. The mechanism lies in the flaw in the virtual machine implementation that allows the minting function to be called without normal permissions and endorsement constraints, while the cross-chain bridge verifies the "burn" event on the Initia side and releases the corresponding locked assets, thus transforming the flaw into cashable liquidity.
ABAB News · Cognitive Laws
Unlimited minting completed first, response came after chain suspension
Virtual supply turned into real extraction through the bridge
Flaw window determines loss limit, not announcement speed