Hacker Mints $2.7M as Initia Blockchain Grinds to a Halt

A Sudden Halt on the Initia Network

Imagine walking into your local bank and discovering that the doors are locked, the lights are off, and a notice on the window says operations are paused. That is essentially what happened to the Initia blockchain ecosystem on Friday, October 23, 2026.

The core development team behind the modular blockchain network took the decision to pause its Layer 1 chain and all connected networks. The emergency action came after security monitoring detected an unauthorized user minting millions of dollars in digital tokens out of thin air.

According to official statements and team disclosures, the attacker managed to siphon off approximately $2.7 million worth of assets before the network was shut down to prevent further losses.

How Does Initia Work?

To understand why this exploit affected multiple parts of the network, it helps to break down how Initia is built.

Initia is designed as a modular blockchain platform. Its primary mission is to make it easy for independent crypto networks and applications to interoperate and talk to each other seamlessy.

Think of Initia's Layer 1 (L1) as a central train station coordination hub, while connected networks, known as rollups, act as express train lines running in and out of the main hub.

• Cosmos SDK & CometBFT: Initia's main L1 chain relies on the Cosmos SDK framework and uses CometBFT consensus to validate transactions quickly.
• Interconnected Rollups: Because Initia coordinates state across linked rollup chains, a vulnerability in the main engine can potentially impact connected systems.
• Move Virtual Machine (VM): The network executes smart contracts using a specialized execution environment based on the Move programming language.

The Anatomy of the $2.7 Million Exploit

Shortly after the incident was confirmed, Initia co-founder Ezaan Mangalji took to social media to explain what caused the vulnerability.

Mangalji explained that the attacker exploited a previously unknown zero-day flaw residing at the intersection of Initia's Move VM and its Cosmos SDK foundation.

"To the best of our knowledge so far, this is a Day 0 bug related to Initia’s Move VM on Cosmos SDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens. The attacker was able to mint and bridge out ~$2.7m worth of AUSDAUSD+0.75%, ETH, and USDCUSDC+0.18% before the chain was paused."

In plain English, the hacker found a loophole in the smart contract engine that allowed them to trick the system into printing fake balance records. They quickly converted these unauthorized tokens into real liquidity, transferring out AUSD, EthereumETH-0.67%, and USD Coin (USDC) before developers stepped in.

Importantly, Mangalji confirmed that the bug did not allow direct minting of Initia's native INIT governance token.

Timeline of the Incident

Here is how the events unfolded throughout the day on Friday, October 23, 2026:

1. 3:41:30 PM UTC: The official timestamp when Initia's L1 and connected rollups were formally halted.
2. 12:00 PM Eastern Time: Initia's official account posted a public confirmation on X.
3. 7:45 PM Eastern Time: Seven hours after the emergency pause, blockchain explorer scan.initia.xyz showed the chain remained frozen at block height 23365925.

"As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident. Our team is actively investigating the situation and working to establish the full scope of any impact with security teams, validators, and exchanges."

Agora Responds: Is the AUSD Stablecoin Safe?

Because the hacker bridged out synthetic AUSD tokens, concerns quickly spread about the stability of Agora, the company behind the digital stablecoin AUSD.

Agora swiftly published official statements to calm market fears and clarify that its core protocols were completely untouched.

"We’re aware of today’s security incident on Initia. Agora has no smart contracts deployed on Initia. Our security team has been monitoring the situation and will freeze funds related to hacker addresses that hold AUSD on chains where AUSD/Agora smart contracts are deployed."

Agora followed up with additional detail to reassure backing and solvency across all active deployments:

"For additional clarity: AUSD and Agora are unaffected. AUSD does not exist on Initia. AUSD deployments on all networks and Agora operations continue as normal. AUSD is fully backed."

Exchanges React and INIT Token Price Movements

Centralized exchanges moved fast to minimize potential contamination. Major South Korean crypto exchange Upbit officially suspended all deposit and withdrawal services for the INIT token until safety checks were completed.

Despite the news of the $2.7 million breach, the native INIT token demonstrated surprising price resilience:

• 24-Hour Performance: After a brief initial dip, INIT recovered and was trading 12.5% higher over the 24-hour period.
• 30-Day Performance: Looking at the broader trend since September 23, the asset showed a 65.8% increase over the past month.

Disclaimer: Past digital asset returns or historical performance do not guarantee future results. Cryptocurrency markets carry high volatility and risks.

What Lies Ahead for Initia?

As of the latest updates from network monitors, the Initia L1 chain remains offline. Core developers, independent auditors, validators, and partner exchanges continue to conduct a thorough code post-mortem.

The core team has not yet given a firm timeline for when normal operations and block production will resume. Users holding assets across connected rollups will need to wait for official patch announcements before full bridging functionality returns.