Initia Halts Blockchain After $2.6M Exploit Drains Funds

Initia halted its layer-1 blockchain and its interconnected rollups, known as Minitias, at 3:41 p.m. UTC on Friday after blockchain sleuths reported an exploit that allowed an attacker to mint tokens without authorization and drain more than $2.6 million in crypto assets. In a post on X, the team said it was working with security researchers, validators and exchanges to determine the full extent of the incident.

Blockchain security researcher Spreek first flagged the exploit on Friday, reporting that the attacker had minted tokens without authorization and converted about $2.6 million into other assets, with additional funds still being moved. DeFi platform D2 Finance later detailed how the attacker exploited a vulnerability in a Move function to mint 2 million AUSD tokens without sufficient backing, then used cross-chain transfers to withdraw roughly 1.4 million AUSD, 105 Ether (ETH) and 1.08 million USDC (USDC) to Ethereum. D2 Finance said the stolen assets were consolidated into an Ethereum wallet holding about 1,135.5 ETH, worth $2.73 million.

Initia's native token, INIT, briefly fell to around $0.115 on Friday before rebounding above $0.15. The token was trading near $0.1496 at the time of writing, an increase of about 14% over the previous 24 hours, according to CoinGecko data.

Initia has not publicly confirmed the estimated losses or the precise cause of the exploit, and the extent of the impact on users and the timeline for restoring network operations remain unclear. Initia is a layer-1 blockchain designed to support a network of interconnected rollups, known as Minitias, and the chain's ability to resume normal operations will depend on the outcome of the investigation and remediation work carried out with validators and security researchers.