Initia Suspends Blockchain After Reported $2.6M+ Exploit Drain

Initia has paused operations of its layer-1 network and rollups after security researchers reported an exploit that allegedly enabled unauthorized token minting and the drainage of crypto funds. The halt was initiated at 3:41 p.m. UTC on Friday, according to a post from Initia on X, as the team coordinated with validators, exchanges, and external researchers to assess the damage.

While Initia has not yet provided a full account of the incident, reports from blockchain analysts and DeFi participants suggest the attacker minted unbacked tokens, converted them across chains, and consolidated proceeds on Ethereum. The event has also spilled into Initia’s token market, where the native INIT token briefly dropped before rebounding.

Key takeaways

• Initia halted its layer-1 and connected rollups at 3:41 p.m. UTC Friday following a reported security incident.
• Security researcher Spreek said an attacker minted tokens without authorization and converted roughly $2.6 million into other assets.
• D2 Finance reported the mint involved 2 million AUSD tokens and that about 1.4 million AUSD, 105 ETH, and 1.08 million USDC were bridged/withdrawn to Ethereum.
• The incident has been linked (by D2 Finance) to a Move-function vulnerability that allegedly allowed creation of unbacked tokens.
• Initia has not yet confirmed the final loss estimate, the exact technical cause, or the timeline for resuming operations.

Network pause after reported minting exploit

Initia’s team said the network was stopped at 3:41 p.m. UTC on Friday after a security incident. In the same announcement, the project indicated it was working with security researchers, validators, and exchanges to understand the full scope of what happened and to reduce the risk of further damage.

According to blockchain security researcher Spreek, the exploit involved an attacker minting tokens without authorization. Spreek’s initial report, shared on X, also described the attacker converting approximately $2.6 million into other assets, with additional funds reportedly still in motion.

For investors and users, the practical significance of the pause is straightforward: when a layer-1 and its rollup ecosystem stop producing or finalizing activity, wallets, DeFi protocols, and trading venues that depend on that chain’s availability may face delays, stuck positions, or reduced liquidity. Until Initia provides more details, market participants are left to monitor how quickly assets can be identified, frozen, or returned.

Details from DeFi platform D2 Finance

Following Spreek’s disclosure, DeFi platform D2 Finance published its own account of the mechanics and scale of the exploit. D2 Finance claimed the attacker took advantage of a vulnerability that allowed minting 2 million AUSD tokens without sufficient backing. The firm further reported that the attacker then used cross-chain transfers to withdraw roughly 1.4 million AUSD along with 105 ETH and 1.08 million USDC to Ethereum.

D2 Finance said the stolen assets were later consolidated into an Ethereum wallet holding about 1,135.5 ETH, which the firm valued at approximately $2.73 million. D2 Finance attributed the root issue to a Move function vulnerability that allegedly permitted the creation of unbacked tokens and their subsequent exchange for Ethereum-based assets.

It’s worth noting the asymmetry in the public numbers: Spreek referenced “approximately $2.6 million,” while D2 Finance later cited a consolidated value near $2.73 million. These figures may reflect different accounting methods, timing, or asset conversion rates, but they at least align on the broader magnitude—suggesting millions of dollars were involved.

What’s confirmed—and what remains unclear

As of the reports, Initia has not publicly confirmed the estimated losses or the precise technical cause. The company has also not provided a clear restoration timetable, leaving participants to watch for updates on (1) which smart contract(s) are implicated, (2) whether additional funds remain in addresses tied to the attacker, and (3) how the chain will be brought back safely.

Cointelegraph was unable to contact Initia for further comment through its official X account at the time of publication. That means the most detailed operational and technical explanations so far come from third-party observers rather than from Initia’s own incident response.

For users, the uncertainty is more than academic. If an exploit involved the minting of unbacked tokens, projects and counterparties that interacted with those tokens—directly or through liquidity pools—may need to assess exposure and decide whether they will seek remediation. Traders, meanwhile, may need to account for the possibility of delayed withdrawals or temporary asset valuation distortions while the chain is offline.

INIT token volatility as trading digests the halt

The incident has already affected Initia’s token performance. According to CoinGecko data, INIT briefly fell to around $0.115 on Friday before recovering to above $0.15. At the time of writing, the token was trading near $0.1496, up roughly 14% over the previous 24 hours.

That rebound does not necessarily signal that the exploit is contained or the final losses are limited; token prices often move on shifting expectations about incident severity, the speed of remediation, and the broader risk appetite of crypto markets. Even so, the volatility underscores how quickly operational disruptions and security incidents can change sentiment.

Investors should also be cautious about reading too much into short-term price action. Without an official assessment from Initia—covering confirmed theft amounts, affected protocols, and the remediation plan—market participants remain exposed to additional announcements that could reverse sentiment.

What to watch next

Next, the key signals are whether Initia confirms the reported Move-function vulnerability, publishes a clearer estimate of total losses, and sets expectations for when layer-1 and rollups will resume. In parallel, users should monitor whether the Ethereum wallet(s) associated with the attacker’s proceeds show signs of being liquidated or otherwise moved as incident response ramps up.