Hacker mints tokens on Initia Chain, cashes out about $2.6 million

17Importance
closedStatus
9News media
Published
Updated

Initia suspended its layer-1 chain and rollups on Oct. 23 after unauthorized token minting was reported, with onchain estimates putting the amount cashed out at about $2.6 million to $2.7 million. Later coverage added that an address tied to the incident moved about 1,135 ETH, while Agora froze an AUSD account linked to the flow of funds.

Key claims & sources

✓
Ethereum records showed stablecoin swaps and a later transfer of 1,135.5 ETH after the exploit was reported.
✓
Onchain data showed a $2.7 million ether transfer while Initia reviewed the security incident.
✓
Agora froze an AUSD account tied to the incident after saying the targeted Ethereum account had already swapped 1.4 million AUSD for ETH.
✓
Initia also halted block production on its layer-1 network and rollups on Oct. 23 after an attacker used an infinite minting flaw, and validator coordination was used to contain liquidity moving to outside bridges.
✓
Security researcher Spreek reported unauthorized token minting on Initia, and Initia said on Oct. 23 that it suspended its layer-1 chain and rollups at 3:41:30 p.m.

What it means

Initia is a modular layer-1 built on MoveVM, the same virtual machine family that powers Aptos and Sui, designed so independent rollups can share liquidity and security. Infinite-minting bugs are a known failure mode in this class of chain, but what set Oct. 23 apart was the response: validators coordinated to halt block production at 3:41:30 p.m., five seconds before an attacker's 1,135 ETH transfer would have settled, a reaction speed unusual for a chain marketed as decentralized.

Anyone with assets on Initia's L1 or its rollups has been locked out since the halt, unable to transact, withdraw or redeem until validators restart the network, and as of Friday evening Initia had given no timeline. Agora's freeze of an AUSD account that had already swapped 1.4 million AUSD for ETH shows a second layer of recourse: centralized stablecoin issuers can claw back funds even after they leave a chain, which helps victims but means the attacker's remaining liquid assets are not guaranteed to be recoverable.

The speed of the validator-led halt cuts against the industry's own pitch that these chains run without a kill switch; stopping an exploit in five seconds required exactly the kind of coordinated control that decentralization is supposed to replace. Agora's ability to freeze AUSD raises the same question from the other side: a stablecoin that can be frozen on command is safer for recovering stolen funds but is not censorship-resistant in the way its holders might assume.

The open questions are when Initia resumes block production on its L1 and rollups, whether a post-mortem identifies the exact MoveVM flaw that allowed unbacked minting, and whether the frozen 1.4 million AUSD and any remaining ETH from the attacker's wallet get returned to the protocol. A published fix and a concrete restart timestamp would settle whether this was a contained incident; continued silence would harden doubts about Initia's security review process.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market

The total crypto market fell 0.2% in the 4 hours after the first headline, after falling 0.9% in the 2 hours before.

$2.7T market cap at the headline
-0.9% 2 h before
-0.2% 4 h after
-0.6% 12 h after
First headline

48 prices, one every 30 minutes · The move was larger before the first headline than after: an observation, not an explanation. The market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 23 15:38
Crypto Briefing scoop
Breaks the event: $2.6M
+41 min
Oct 23 16:19
The Defiant context
Its angle: stablecoin, later
+1 h 26 m
Oct 23 17:03
+1 h 30 m
Oct 23 17:08
The Defiant adds
Brings into the story: AUSD, with quotes
+1 h 49 m
Oct 23 17:27
The Defiant echo
No new facts: deployed, product, adapter; with quotes
+3 h 1 m
Oct 23 18:39
Cointelegraph context
Its angle: researchers, transferred, millions
+3 h 40 m
Oct 23 19:18
Crypto Economy context
Its angle: infrastructure, interconnected, vulnerability; with quotes
+5 h 16 m
Oct 23 20:54
crypto.news echo
No new facts: suspension, statement, effect
+5 h 37 m
Oct 23 21:15
CR Cryptopolitan adds
Brings into the story: ETH, with quotes
+10 h 57 m
Oct 24 02:35
Unchained context
Its angle: pseudonymous, transactions, preliminary; with quotes
+11 h
Oct 24 02:38
The Crypto Guardian echo our clock
No new facts: implementation, confirmation, independent; with quotes
+17 h 22 m
Oct 24 09:00
AMBCrypto echo
No new facts: concerns, fresh, again

Thefts of a similar size

WhenWhat happenedFigure
5 months ago RetoSwap · Malicious proposal incident $2.7M
6 months ago RetoSwap · Missing Input Validation incident $2.7M
8 months ago SolvBTC · Infinite Mint incident $2.7M
11 months ago Aevo · contract vulnerability incident $2.7M
11 months ago Ribbon · Improper access control incident $2.7M

4308 incidents stored · 657 were as large as this one or larger ($2.7M)