Initia halts chain after MoveVM bug lets attacker mint $2.7M

Initia, a layer-1 blockchain built to connect a network of rollups, stopped its main chain and every rollup on Friday after an attacker found a way to create tokens out of thin air and move about $2.7 million off the network. The Block reported the halt; Initia said on X that its L1 and rollups had been paused as of 15:41 UTC.

What went wrong

Co-founder Ezaan Mangalji, known as Zon, said early findings point to a "Day 0" bug in Initia's MoveVM implementation on the Cosmos SDK, the code that executes Move smart contracts on the chain. The flaw allowed unauthorised minting of tokens, but Zon said it "does not apply to native INIT tokens".

According to Zon, the attacker minted and bridged out roughly $2.7 million worth of AUSD, ETH and USDC before validators stopped the chain. On-chain researcher Spreek, who first flagged the activity, put the cashed-out sum at about $2.6 million with more funds in transit at the time.

How the money left

Analysts at D2 Finance traced one transaction at 14:59 UTC that created 2 million AUSD without backing. About two and a half minutes later, a cross-chain message released 1.4 million real AUSD from a bridge adapter on Ethereum. The stablecoins were then swapped for ether, and roughly 1,135 ETH ended up in a fresh wallet, according to the firm. AUSD issuer Agora said it froze the linked account, but by then the tokens had already been swapped.

This is the classic way a minting bug turns into real losses: fake tokens on one chain are only worth something if a crypto bridge accepts them and pays out genuine assets on another. It echoes this week's Cysic bridge incident, where an unauthorised mint also forced a shutdown.

Market reaction and what's next

INIT fell about 14% right after the exploit was reported, then reversed and traded roughly 14% higher on the day, The Block said. Initia says it is working with security teams, validators and exchanges to measure the damage and has not yet confirmed the amount lost or a restart date.

Watch for a post-mortem, any recovery plan for bridge liquidity, and whether exchanges keep INIT deposits and withdrawals open. Exploits of this kind are a large share of crypto losses, as the Q3 hack tally shows.