Initia halted its Layer 1 blockchain and connected rollups on October 23 after investigators reported an exploit that allowed unauthorized issuance of tokens and transfers of roughly $2.7 million in digital assets away from the network. The emergency shutdown interrupted the ecosystem’s normal settlement and cross-chain activity while security teams investigated the flaw.
Co-founder Ezaan Mangalji, known as Zon, said preliminary evidence pointed to a previously unknown vulnerability in the Move virtual machine, or MoveVM, running within Initia’s Cosmos SDK implementation. He said the problem did not apply to native INIT tokens. An outside blockchain researcher initially estimated that the attacker had converted about $2.6 million, but Initia itself has not published an audited final loss figure.
A further complication emerged as Agora, the issuer of the AUSD dollar stablecoin, disputed any suggestion that its own stablecoin contract had been exploited on Initia. It said no AUSD contract was deployed on that network and no AUSD was minted there. That does not rule out damage involving bridged or represented assets; it makes the technical attribution and accounting more important than headlines describing unlimited AUSD creation.
When Did Initia Halt Its Layer 1 Network and Rollups?
In its October 23 incident notice, Initia said the Layer 1 network and rollups were halted at precisely 15:41:30 UTC. The team said it was working with security specialists, validators and exchanges to establish the scope of the incident and would publish confirmed information through its official channels.
The timing is significant. Analyst Spreek had reported suspected token creation and transfers shortly before the shutdown, putting the network into an emergency containment process. A network halt prevents new ordinary transactions from being finalized through the affected chain while validators coordinate a safe response.
It also prevents legitimate activity. Applications dependent on Initia’s settlement environment can experience interrupted deposits, transfers, bridge operations and other state changes. The announcement was a security measure, not a statement that every application or rollup had independently been hacked.
Initia has not provided a complete publicly verified sequence of the attack, patch deployment, independent security review and restart time in the sources reviewed. A third-party service status page showing operational infrastructure should not be treated as proof that block production or ordinary transfers have resumed after the explicitly announced chain halt.
Users should distinguish exchange trading in existing INIT tokens from movements on the Initia chain. An exchange may continue matching orders using its internal ledger while blocking deposits and withdrawals through a suspended network.
What Did the Co-Founder Say About the MoveVM Vulnerability?
Mangalji said in an October 23 update that preliminary findings indicated a previously unknown vulnerability in the MoveVM implementation used with the Cosmos SDK. The bug allegedly allowed token issuance without the authorization expected under normal protocol rules.
Move is a programming language and virtual-machine architecture used by several blockchain ecosystems. A problem in a particular implementation of MoveVM on Initia does not automatically mean every chain using Move has the same flaw. Investigators would need to identify the exact module, affected software version and validation step that failed.
The co-founder expressly distinguished unauthorized asset minting from the native INIT supply, saying the observed issue did not apply to INIT tokens. That narrows an important fear, but it does not establish that every token on the network was unaffected or that all bridge reserves remained fully backed.
There is a technical difference between minting a native asset, increasing a locally represented bridged asset without valid collateral, and triggering the release of already existing tokens on another blockchain. All can create financial losses under the right conditions, but they operate through different smart contracts and accounting systems.
Until Initia releases the exploit trace and source-code analysis, the exact point where unauthorized balances became valuable cross-chain assets remains preliminary. This is particularly important because some of the tokens mentioned in early reports are issued and managed by projects outside Initia.
How Did the Attacker Reportedly Move About $2.7 Million?
According to Mangalji’s preliminary account, the attacker minted and bridged out approximately $2.7 million worth of assets associated with AUSD, ETH and USDC before validators paused the chain. Blockchain investigator Spreek initially put the amount cashed out at around $2.6 million, warning that additional funds were in transit.
Those numbers should not be added together into a $5.3 million theft. They are overlapping early estimates describing stages of the same incident, with different definitions of the amounts minted, transferred or converted. A definitive loss must reconcile the affected token liabilities against genuine locked collateral and actual assets that left authorized custody.
Ethereum transaction records highlighted in early reports show an outbound transfer of approximately 1,135 ETH, then valued above $2.7 million, to the address 0x358eF0130f7A5aA516dCd81Bdc80B18CdE41CAC8. The on-chain transfer is observable; the assignment of that wallet to the exploit depends on the linked transaction reconstruction.
The record of ETH reaching another address does not necessarily show that the operator sold it for bank money, used a mixer or completely escaped asset-recovery efforts. A bridge payout and a completed fiat cash-out are different events. Furthermore, ETH received through swaps of AUSD or USDC should not be reported as an additional loss on top of the initial transferred stablecoins.
The distinction resembles the tracing of Drift exploit-linked funds, where a subsequent ETH movement was not evidence of a new theft on the day of the transfer. The transactions and suspected actors in the two incidents are unrelated on the evidence now available.
Why Is Agora Disputing Claims About AUSD Minting?
Agora, which issues the AUSD stablecoin, said on October 23 that its AUSD token contract is not deployed on Initia, so the attacker could not have minted native, issuer-controlled AUSD directly on Initia. The company described an incident involving a third-party product that used AUSD on Ethereum rather than a compromise of Agora’s own issuance contract.
That statement requires careful wording because an Initia-side representation of AUSD can still exist through a bridge or application. A compromised representation may be exchanged or redeemed for legitimate assets elsewhere if the bridging system fails to validate its backing. The underlying issuer’s contract can remain secure while losses arise at the integration layer.
Early transaction analyses described 1.4 million AUSD moving out of an Ethereum bridge adapter and being exchanged for approximately 581.6 ETH. The public evidence has not yet established the complete supply-versus-collateral accounting for every asset in the incident, and Agora’s statement directly cautions against attributing an AUSD issuer-level mint to the exploit.
Agora also said it would freeze AUSD associated with attacker-controlled addresses where its contracts permit that intervention. Whether those actions will recover value for affected users depends on what balances remained when restrictions were applied and on the ability to identify the correct destination addresses.
Issuer controls can affect a stablecoin after an exploit, but they cannot undo all past cross-chain movements. DaveFinances’ reporting on billions of dollars in stablecoin freezes examined why blocking a token and demonstrating the underlying basis for that action are separate questions. It does not establish anything about Agora’s culpability in this incident.
How Are Exchanges and INIT Traders Affected?
Several cryptocurrency exchanges responded to Initia’s network disruption by suspending deposits and withdrawals of INIT. South Korean platforms Upbit and Coinone announced restrictions as the incident unfolded, while a Kraken service notice also identified a temporary INIT funding pause. Those actions are consistent with the inability to process ordinary blockchain deposits and withdrawals during a chain halt.
They do not automatically mean trading was suspended everywhere or that exchanges identified native INIT tokens as having been illicitly minted. The co-founder’s initial explanation says the issue does not affect the native token’s minting rules. Exchange funding precautions can still be appropriate when settlement is unavailable.
The INIT token was volatile following the disclosure. The Block reported an initial 14% decline, followed by a recovery that left the asset up approximately 14% on the day at the publication’s observed point. Those are time-specific reported prices, not a current live quotation or evidence that the technical risk had been resolved.
Price rebounds sometimes reflect short covering, speculative buying or changes in perceived worst-case losses. Without exchange position and order-flow data, none of those explanations can be established for this move. Traders should not equate a rising market price with confirmed recovery of bridged assets.
The more important operational indicators are resumed network block production, independent validation of the patch, the safe reopening of bridges and exchange funding services, and an accounting of any obligations to holders of wrapped or cross-chain representations.
What Must Initia Confirm Before a Safe Restart?
A credible post-incident report should first identify the affected MoveVM function and explain how authorization or supply checks were bypassed. It should then document whether validator nodes were patched consistently and whether replaying attack transactions would fail under the repaired implementation.
Second, investigators should reconcile each affected asset: unauthorized balances created on Initia, legitimate reserves supporting bridged representations, amounts released on other networks, recovered tokens and net liabilities after any freezes. The public $2.6 million to $2.7 million estimates are starting points rather than audited accounts.
Third, exchanges and applications need a consistent restart plan to prevent accidental processing of unsafe transfers or duplicated claims. A network restart can restore basic transaction processing without automatically returning assets already transferred away.
Users should rely on verified Initia and exchange channels for resumption notices, and avoid websites or direct messages asking them to reconnect wallets or sign urgent recovery transactions. Following a high-profile exploit, fake compensation links and wallet-draining impersonation can cause further harm.
The pattern is relevant to another earlier exploit-related transfer investigated by DaveFinances: identifying a wallet associated with an incident helps reconstruct what happened, but does not establish recovery or eliminate later fraud risks for ordinary users.
As of the latest publicly verifiable incident information reviewed on October 23, Initia had confirmed the halt of Layer 1 and its rollups, the co-founder had identified a suspected MoveVM minting flaw, and researchers had traced millions in assets away from the ecosystem. The precise net loss, final cause, cross-chain liability and restart timetable still require verified technical disclosures. Agora’s separate statement also means the incident must not be misreported as an authenticated compromise of the AUSD issuer’s own minting contract.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574