Freeze Frame: Initia Halts After a Reported $2.6M+ Minting Heist

Initia halted its layer-1 blockchain and rollups at 3:41 p.m. UTC on Friday after blockchain sleuths reported an exploit that allowed an attacker to mint tokens without authorization and drain more than $2.6 million in crypto assets. In a post on X, Initia said it was working with security researchers, validators and exchanges to determine the full extent of the impact.

Blockchain security researcher Spreek first flagged the exploit on Friday, reporting that an attacker had minted tokens without authorization and converted approximately $2.6 million into other assets, with additional funds still being moved. DeFi platform D2 Finance later reported that the attacker exploited a vulnerability to mint 2 million AUSD tokens without sufficient backing.

The attacker then used cross-chain transfers to withdraw approximately 1.4 million AUSD, 105 Ether (ETH) and 1.08 million USDC (USDC) to Ethereum. The stolen assets were subsequently consolidated into an Ethereum wallet holding approximately 1,135.5 ETH, worth $2.73 million, according to D2 Finance. The firm attributed the exploit to a vulnerability in a Move function that allowed the attacker to create unbacked tokens and exchange them for assets on Ethereum.

Initia is a layer-1 blockchain designed to support a network of interconnected rollups, known as Minitias. Its native token, INIT, briefly fell to around $0.115 on Friday before rebounding above $0.15, according to CoinGecko data. The token was trading near $0.1496 at the time of writing, an increase of about 14% over the previous 24 hours.

Initia has not publicly confirmed the estimated losses or the precise cause of the exploit, and the extent of the impact on users and the timeline for restoring network operations remain unclear. Cointelegraph was unable to contact Initia for additional comment through its official X account.