Initia halts blockchain after exploit reportedly drains over $2.6M

Initia halted its layer-1 blockchain and rollups after blockchain sleuths reported an exploit that allowed an attacker to mint tokens without authorization and drain more than $2.6 million in crypto assets.

The network was halted at 3:41 p.m. UTC on Friday following a security incident, Initia said in a post on X. The team said it was working with security researchers, validators and exchanges to determine the full extent of the impact.

Blockchain security researcher Spreek first flagged the exploit on Friday, reporting that an attacker had minted tokens without authorization and converted approximately $2.6 million into other assets, with additional funds still being moved.

DeFi platform D2 Finance later reported that the attacker exploited a vulnerability to mint 2 million AUSD tokens without sufficient backing. The attacker then used cross-chain transfers to withdraw approximately 1.4 million AUSD, 105 Ether (ETH) and 1.08 million USDC (USDC) to Ethereum.

The stolen assets were subsequently consolidated into an Ethereum wallet holding approximately 1,135.5 ETH, worth $2.73 million, according to D2 Finance. The firm attributed the exploit to a vulnerability in a Move function that allowed the attacker to create unbacked tokens and exchange them for assets on Ethereum.