Exploit Drains About $2.7 Million in Assets, Prompting Initia to Halt Its Network
Key Facts
Initia halted its Layer 1 network and rollups on October 23 at 15:41:30 UTC after discovering a security flaw that allowed unsupported token balances to be created and real assets to leave the network. The project’s founder estimated that about $2.7 million in assets left before the shutdown, including AUSD, ETH and USDC, according to The Block. The network remained offline through publication on October 26, with no announced restart date. Initia has not confirmed the final loss and said it is investigating the scope of the incident. Until the investigation and repairs are complete, user access to the network and their assets remains the central consequence of the exploit.
Initia’s founder said initial findings pointed to a previously unknown flaw in MoveVM’s implementation on Cosmos SDK that allowed tokens to be created without authorization. He described the flaw as a “Day 0” vulnerability and said it “does not apply to native INIT tokens.” A project update explained that the flaw involved how MoveVM stores temporary scripts. According to the update, the vulnerability allowed malicious code to bypass security checks and spoof MoveVM state. This mechanism separates the creation of balances that appear to exist on the network from the real assets that left through bridge routes.
Altcoin Buzz described a single transaction that created two million AUSD on Initia, but that account does not mean the native AUSD token was minted there. Agora said the AUSD contract is not deployed on Initia and that the incident involved a third-party product using AUSD. It also said it has no smart contracts deployed on the network. Initia said the fake balances cited were AUSD balances on Initia and that no new INIT was minted. The project added that the total supply of INIT was not affected by the flaw.
According to a project update cited by Altcoin Buzz, assets left through two separate routes before the network was halted. The first route involved 105 WETH and about 1.4 million AUSD0 via LayerZero. The second transferred about 1.08 million USDC via Noble and CCTP. These details show that the real assets that left were not merely the fake balances created within Initia. After reaching Ethereum and being swapped, the assets were consolidated into a balance of 1,135.52 ETH, the report said.
Initial estimates of the value of funds drained differed from the founder’s later estimate of the assets that left. Blockchain researcher Spreek initially estimated that about $2.6 million had been drained and said additional funds were still being transferred. The Block later cited Initia’s founder as estimating that about $2.7 million in assets left before the network was halted. Initia has not confirmed the final loss, so the $2.7 million figure remained an estimate attributed to the founder, not a publicly confirmed final tally. The estimate covers multiple assets—AUSD, ETH and USDC—not just the unsupported balances.
In trading, INIT fell 14% immediately after the exploit was reported on October 23, before reversing its losses. It was up about 14% on the day when The Block published its report. Initia’s founder said the flaw does not apply to INIT, and the network also said the token’s total supply was unaffected. The price move came on the day the incident was reported, as the network halted operations and began its investigation. The report gave no specific token price or further trading details after that day.
Initia said it is working with security teams, validators and exchanges to determine the full scope of the incident, while pursuing asset recovery with security partners. An October 24 update said the security fix was still in progress and was expected to be completed and audited within a few days. The project gave no date for restarting the Layer 1 network or its rollups. The restart therefore remained contingent on completing the fix and audit, while the investigation continued into the assets that left and the impact of the flaw.