Initia Halts L1 and Rollups After Infinite-Mint Exploit Drains $2.7M

Initia halted its layer 1 blockchain and its connected rollups on October 23 after an attacker exploited a flaw in the network's token minting mechanism to mint tokens beyond the supply limit, extracting approximately $2.7 million in cryptocurrencies including AUSD, USDC and Ether. Co-founder Ezaan Mangalji attributed the incident to a day-0 bug in Initia's MoveVM implementation built on the Cosmos SDK, though he shared that assessment while the investigation was still open and the root cause has not been formally confirmed.

The network stopped producing blocks at height 23,365,925, according to the announcement on Initia's official X account. The halt came too late to stop the extraction itself: the attacker moved a portion of the newly minted tokens across a blockchain bridge and swapped them for assets carrying real market value before validators took the chain offline.

How the mint exploit worked

Every blockchain enforces rules that define how many tokens can be produced and which parties hold minting authority. Those rules exist precisely to prevent unauthorized supply expansion. In Initia's case, a loophole in the code allowed a minting request to pass without a correct validation check.

The attacker minted tokens without depositing funds or posting the required collateral. Because the minted tokens satisfied the network's internal validity rules, they circulated as legitimate assets within the affected network despite lacking any backing. The conversion step — bridging the tokens and exchanging them for real-value assets — is what turned a supply integrity failure into a $2.7 million loss.

A day-0 bug, not a regression

Mangalji's framing carries operational weight. A day-0 bug is a flaw present in a system from its earliest implementation, unnoticed until discovery or exploitation. That distinguishes this incident from a regression introduced by a recent software update: the vulnerability was likely latent for the network's entire operating history, available to any party who found it.

The technical stack matters for practitioners. The Cosmos SDK provides the framework for building application-specific blockchains; MoveVM executes the smart contracts that manage digital assets. Initia combines the two and supports rollups that run Move alongside the Ethereum Virtual Machine, which means the blast radius of a MoveVM-level flaw extends across the L1 and its interconnected rollup ecosystem — the reason Initia halted both simultaneously.

What does this change for holders and exchanges?

The halt splits the INIT holder base into two distinct positions. Users holding tokens directly on the network cannot transfer them until operators resume block production; control of private keys does not help when the chain itself refuses to process transactions. On-chain balances are frozen, not lost, but the freeze has no announced endpoint.

Holders on centralized exchanges sit in a different position. Exchanges maintain their own internal account records, so balances tracked off-chain are not automatically affected by the halt. Upbit, the South Korean exchange, nonetheless suspended INIT deposits and withdrawals following the incident — a standard containment measure, since the exchange cannot confirm incoming transfers on a chain that has stopped producing blocks.

For practitioners, the incident is a case study in how a virtual-machine-level mint validation flaw propagates: unlimited mint, bridge exit, swap into liquid assets, and only then a coordinated halt. The $2.7 million figure reflects what the attacker extracted before block production stopped at height 23,365,925, not the nominal value of tokens minted, which may be far larger.

The forward path depends on two unconfirmed items: the completed root-cause analysis of the MoveVM bug, and a restart timeline for the L1 and its rollups. Until Initia publishes both, INIT transfers on-network remain suspended and exchange deposit and withdrawal windows stay closed.