Initia halts L1 and rollups after $2.7 million exploit — What happened?

Initia, a Layer 1 blockchain and interwoven modular roll-up network, suffered a major security incident on 23rd October. An attacker allegedly exploited a vulnerability in its blockchain to create tokens without permission and withdraw real assets from cross-chain bridges. 

According to the investigation, the attack began at 14:59:26 UTC when the exploiter used a single signed transaction to mint 2 million AUSD tokens out of thin air on Initia.

The transaction reportedly consumed 135,888 gas and called a ‘Move’ function directly, without requiring a cross-chain bridge message. So, instead of breaking the bridge’s security verification process directly, the attacker hacked a vulnerability in the token-minting mechanism.

All about Initia’s security incident

The attacker didn’t stop there though. Instead, they exploited cross-chain infrastructure to convert these unauthorized tokens into real assets on Ethereum [ETH]. So, roughly 153 seconds after the initial mint, a valid LayerZero message enabled the release of 1.4 million AUSD from the Ethereum-side adapter.

At the same time, the attacker also withdrew 105 ETH from the native-ETH adapter and obtained 1.08 million USDC through Circle’s Cross-Chain Transfer Protocol (CCTP). According to researchers, the attacker converted the funds into Ethereum through decentralized trading services, including 1inch and 0x.

Here, within approximately 7 minutes of the initial mint, around $2.65 million had reached Ethereum. The consolidated funds later amounted to 1,135.52 ETH, worth approximately $2.73 million, held in a newly created wallet.

This seemed to be very similar to September’s Liquid Network incident, where a software bug enabled the creation of unauthorized L-BTC and the withdrawal of real Bitcoin.

As expected, the incident forced Initia to halt its L1 blockchain and roll-ups. And yet, despite this rollercoaster, Initia’s token INIT was trading at $0.1484 at press time after a hike of 11.7% in the last 24 hours. 

2026 has so far being a tricky year for security incidents like these. In fact, AMBCrypto’s recent report found that crypto security losses surged by 55% to $1.18 billion in Q3 2026, while reported incidents jumped from 67 to 107. 

Final Summary

• Transaction reportedly consumed 135,888 gas and called a ‘Move’ function directly, without requiring a cross-chain bridge message.
• This was very similar to September’s Liquid Network incident, where a software bug enabled the creation of unauthorized L-BTC and the withdrawal of real Bitcoin.