Initia halts its chain and rollups after a reported unlimited-mint exploit; about $2.6 million already cashed out

Initia, the layer-1 blockchain behind the INIT token, halted its main chain and all of its rollups at 15:41:30 UTC on Friday 23 October because of a security incident, the project said on X. Fourteen minutes earlier, the on-chain analyst Spreek had posted that the chain was hacked, that several tokens had been minted without limit and that the attacker had cashed out about $2.6 million, with more in flight. Initia has confirmed the halt but not the exploit, its size or its cause.

Spreek’s post went out at 15:27 UTC. It said, in full, that the Initia chain had been “hacked and a bunch of tokens infiniminted”, and that $2.6 million had been cashed out so far. TechFlow relayed it at 15:44 UTC, noting that Initia had not yet responded.

Initia’s notice followed at 16:00 UTC. It gave the halt time to the second and said the team was working with security teams, validators and exchanges to establish “the full scope of any impact”. It added that verified information would come only through official channels and asked users to stay wary of unofficial links, messages and claims.

No security firm had published its own analysis by 16:40 UTC. Coindaro found no report from PeckShield, CertiK, SlowMist or Cyvers, and no post-mortem from Initia. The outlets covering the Initia exploit so far, among them The Defiant, Crypto Briefing, PANews and TechFlow, all rest on the same two sources: Spreek and Initia’s own post.

Initia exploit: what is confirmed and what rests on one analyst

The halt is official, and so is its timing. Initia’s post, which Upbit also cites in its own notice, is the project’s only public statement so far. It does not use the words exploit, hack or mint.

Everything else comes from Spreek. The mint itself, the $2.6 million cashed out, the wallets and the amounts they hold all trace back to the analyst’s posts. Crypto Briefing adds one piece of evidence: it says the minting can be tied to a transaction visible on the official Initia explorer. It gives no hash, and Coindaro has not seen that transaction.

Several basic facts are still missing. Initia has not named the module or contract that was abused, the tokens that were minted or the total minted. It has not listed which rollups are affected, beyond “rollups” in general. It has given no date for a restart.

Where the money went: about 1,102 ETH on Ethereum

Part of the value has already left Initia. TechFlow, citing Spreek, reported that an Ethereum address starting with 0xDD9 and linked to the attacker held about 1,102 ETH, worth roughly $2.65 million, and that the address had first been funded through Tornado Cash, the mixer. The Defiant wrote that Ethereum records show stablecoin swaps and a later transfer of 1,135.5 ETH. None of the sources names the bridge or route used to move the funds from Initia to Ethereum.

Another wallet on Initia, also linked to the attacker, still held about $4.54 million in assets, TechFlow wrote, again citing Spreek. While the chain is halted, no transaction can be processed on it, so those balances cannot move for now. Initia has not said whether that was a reason for stopping everything.

The list of assets matters for INIT holders. The holdings Spreek named are stablecoins and ETH, not INIT. Whether INIT itself was among the minted tokens is not known. Nobody has said so, and nobody has ruled it out.

What a mint exploit and a chain halt mean for holders

A token’s supply is supposed to grow only under fixed rules: a bridge mints a wrapped token when real assets are locked on the other side, a stablecoin contract mints when collateral arrives. A mint exploit breaks that link. The attacker creates tokens backed by nothing, then swaps them for real assets such as USDC or ETH before pools and exchanges notice. The loss lands on whoever took the fake tokens in exchange: liquidity pools, lenders, or any user who traded against them.

A chain halt is the emergency brake. Validators stop producing blocks, so nothing goes through: no transfers, no trades on the chain’s own exchanges, no staking or unstaking, no bridging out. A halt does not lose funds or save them. It freezes them where they were at the last block. When the chain restarts, validators could in principle also decide through governance what to do with the attacker’s balances; Initia has announced nothing of the kind. For where attacks usually happen, see our guide on whether a blockchain can be hacked, and our glossary entry on what a rollup is.

What INIT holders can and cannot do now

• INIT and other tokens held in a wallet on Initia or one of its rollups cannot be moved until the chain restarts. No transaction signed now will be processed.
• Initia warned users against unofficial links and messages. Fake “refund”, “claim” or “migration” pages tend to appear during a halt; Initia said verified updates would come only from its official channels.
• INIT held on a centralised exchange sits in the exchange’s books, not on the halted chain. Trading there can continue, but deposits and withdrawals depend on the chain and on each exchange’s own notice.
• Any decision to buy or sell during an open security incident is taken with missing information: the size of the exploit and the fate of INIT’s supply are both unknown.

Upbit suspends INIT deposits and withdrawals

Upbit, South Korea’s largest exchange, suspended INIT deposits and withdrawals in a notice posted at 15:57 UTC (00:57 on 24 October in Seoul), citing signs of a security incident on Initia and the protection of its users. The suspension runs until Upbit confirms that transfers are stable again; returns of mistaken deposits and the registration of withdrawal addresses are paused too. At 16:15 UTC the exchange added a trading caution notice warning that INIT’s price could become more volatile. Trading itself was not halted.

PANews reported that Bithumb, the other large Korean platform, had also suspended INIT deposits and withdrawals, and the Korean outlet Economybloc wrote that Bithumb issued an investment caution. Coindaro could not open Bithumb’s notice page to confirm either. No other exchange had published a notice that we could find.

INIT price: up on the day despite the halt

INIT traded near $0.1375 at about 16:42 UTC, according to CoinGecko, up about 7.8% over 24 hours, in a 24-hour range of $0.1141 to $0.1491. The same page said INIT had dropped 2.8% after the hack was reported. Its market capitalisation was about $28.9 million. On that basis, the $2.6 million reported as cashed out equals about 9% of the token’s market value. The price can still move sharply once the size of the mint is known.

A young chain with audits and one earlier stop

Initia launched its mainnet in 2025. It is an L1 to which many rollups, which it calls interwoven rollups, are attached; they are built on the Cosmos SDK and support both MoveVM and EVM, according to Crypto Briefing. INIT has a supply of 1 billion tokens. The project raised about $24 million, from backers including Binance Labs and Delphi Digital, and its code went through several audits, the same outlet says. It also recalls that a configuration error on staking rewards in 2025 was fixed by a governance vote and was not an exploit.

One rollup has already shut down this year, for a different reason. Rave stopped at block 32,380,209 on 3 August 2026 and its users were reimbursed one for one, according to the governance proposal that organised it. That was a planned closure, not an attack. Coindaro found no earlier exploit of Initia.

The fourth reported mint bug in eight days

The Initia exploit, if confirmed, would follow a run of similar cases. On 16 October, a Pirate Chain bug minted 39.8 million ARRR. On 17 October, NEAR Intents published a postmortem showing that a deposit notification bug minted $3.8 million in ghost funds. The next day, the Cysic bridge exploiter sent 300 ETH to Tornado Cash. The projects and their code differ. The method is the same: tokens created without backing, then turned into real assets before anyone can stop the flow.

What comes next for Initia

The next steps are Initia’s to announce: the scope of the incident, the module that failed, whether INIT supply was touched, how the chain and its rollups will restart, and whether users who lost funds will be covered. None has a date. Upbit will reopen INIT transfers only through a new notice. Spreek’s figures may also change as more of the attacker’s transactions are traced. Coindaro will update this article when Initia or a security firm publishes its findings.