Initia halted its Layer 1 blockchain and connected rollups on Friday after a reported exploit that allowed an attacker to mint tokens without the required backing, forcing the project to freeze activity while security teams trace the flow of funds.
Crypto researcher Spreek said the vulnerability enabled unlimited token minting and estimated that the attacker had already converted roughly $2.6 million in assets, with additional funds still moving through wallets and bridges. Initia had not disclosed a final loss estimate as of Friday.
The shutdown placed Initia’s core network and its linked rollups into a controlled pause, preventing normal transaction processing while validators, security specialists and exchanges reviewed the incident. The project said it was investigating the exploit’s scope and tracking onchain activity associated with the attacker.
Reported minting flaw drained AUSD liquidity
The reported attack centered on a bridge mechanism that should have required a corresponding deposit before issuing new tokens on the destination network. According to the incident account, the affected software failed to validate that backing, allowing tokens to be created through a malicious command without matching collateral.
The attacker reportedly minted 2 million unbacked AUSD tokens in a single transaction. About 153 seconds later, the exploit path transferred 1.4 million real AUSD to an address controlled by the attacker, according to the transaction sequence described in the incident report.
That pattern would allow counterfeit tokens to be exchanged for genuine assets held by a bridge or liquidity pool. In bridge exploits, the immediate damage often comes less from the newly created tokens themselves than from their ability to redeem or trade against reserves that were funded by legitimate users.
Spreek’s initial assessment was that the attacker had cashed out about $2.6 million. The researcher also said some funds remained in transit, leaving the final scale of the loss unclear while addresses and cross-chain transfers continued to be examined.
Etherscan shows more than 1,100 ETH leaving exploiter wallet
An outbound transaction from the exploiter address listed on Etherscan transferred approximately 1,135 ETH, valued at more than $2.7 million at the reported time of the transaction. The transfer provided one of the clearest public indicators that assets linked to the exploit had moved beyond the initial minting event.
Transfers in ETH can complicate recovery efforts because stolen funds may be routed through multiple wallets, converted into other assets, or sent across networks. Initia’s decision to coordinate with exchanges suggests the project is seeking to identify points where assets could be frozen or monitored if the attacker attempts further conversions.
The available information did not establish whether the 1,135 ETH transfer represented the full proceeds of the exploit, a portion of the attacker’s holdings, or funds consolidated from several transactions. Initia’s investigation remains focused on mapping the affected assets and determining whether any additional contracts or pools were exposed.
INIT recovered after an early sell-off
INIT initially fell 14% after the exploit report emerged, reflecting an immediate reaction from traders to the network halt and uncertainty around the bridge’s reserves. The token later erased that decline and traded about 14% higher on the day, according to the market data cited in the incident report.
The sharp reversal does not settle the underlying questions around the exploit. Token prices can react quickly to a network pause, but the eventual market impact will depend on the confirmed size of the loss, whether reserves can be restored, and how Initia handles the chain restart.
A suspension can limit further damage when an exploit affects infrastructure used across multiple connected networks. Initia’s architecture links its Layer 1 chain with rollups, which are networks that process activity separately while relying on another chain for settlement or security functions. Pausing both the base chain and connected rollups indicates that the project treated the incident as potentially wider than a single application-level failure.
Bridge security comes under scrutiny
The reported flaw puts attention on the bridge’s validation logic: the software rules that determine whether a token issuance is supported by assets locked elsewhere. A bridge that accepts an unverified mint request can turn a localized coding or configuration error into a direct claim on real collateral.
Initia has not yet published a detailed technical explanation of how the malicious transaction passed the bridge’s checks, whether the issue arose in contract code or broader network logic, or what remediation will be required before services resume. Those details will shape whether the response involves a contract upgrade, a chain restart, a rollback decision, or changes to validator and bridge controls.
For users with assets tied to Initia’s connected applications, the operational concern is whether funds were held in contracts exposed to the faulty minting route. The network pause restricts normal movement of those assets, while any restart would need to address the balance between restoring access and preventing exploit-created tokens from remaining in circulation.
Initia’s next updates are likely to focus on the amount of unbacked AUSD created, the value successfully extracted, the status of the attacker’s remaining wallets, and the technical conditions for reopening the Layer 1 chain and its rollups.
Worried about exploits like Initia’s? Learn how to trade more securely with Toobit’s crypto safety standards guide.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
