AnswersPublished24 sources
How a MoveVM Flaw Led Initia to Halt Its L1 and Rollups
Initia halted its layer 1 network and connected rollups at 15:41:30 UTC on October 23, 2026, after an attacker moved assets valued at roughly $2.6–$2.7 million to Ethereum.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Initia halted its layer 1 network and connected rollups at 15:41:30 UTC on October 23, 2026, after an attacker moved assets valued at roughly $2.6–$2.7 million to Ethereum.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What happened in the October 23, 2026 Initia security incident, including the timing and scope of the layer-1 and rollup halt, Spreek’s init. Article summary: Initia halted its layer-1 blockchain and connected rollups at 15:41:30 UTC on October 23, 2026, after an attacker created unbacked token balances and bridged assets to Ethereum; initial estimates put the amount extracted. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
Initia halted its layer-1 blockchain and connected rollups at 15:41:30 UTC on October 23, 2026, after reports of an exploit that let an attacker create unbacked token balances and move assets to Ethereum. Researcher Spreek initially estimated that about $2.6 million had been cashed out; co-founder Ezaan “Zon” Mangalji later put the bridged amount at roughly $2.7 million. Neither figure was a final accounting of losses. 5
19
What happened
Initia’s first public notice confirmed that its L1 and rollups had been halted because of a security incident. The team said it was working with security teams, validators and exchanges to assess the impact, and warned users to be cautious of unofficial links, messages and claims. 15
Spreek had flagged suspicious activity roughly 14 minutes before the halt, according to reporting on the incident. The first malicious transaction identified by D2 Finance was earlier still, at 14:59:26 UTC. 5
16
Mangalji’s initial explanation described a suspected “Day 0” bug in Initia’s MoveVM implementation on Cosmos SDK. He said it enabled unauthorized token creation on Initia’s L1 but did not affect native INIT. 19
27
Initia later described the issue more specifically as a MoveVM script-caching flaw: malicious code could bypass security checks and spoof MoveVM state, crediting the attacker with unbacked balances without changing the affected tokens’ total supplies. Initia said native INIT was not minted and its total supply was unaffected. 37
The reported transaction timeline
D2 Finance’s on-chain account traced the activity from an initial transaction to withdrawals on Ethereum. The distinction matters: early reporting described the activity as token minting, while Initia’s later explanation said the exploit spoofed account balances without changing token supplies. 16
37
| Time (UTC) | Reported activity |
|---|---|
| 14:59:26 | D2 Finance said a signed transaction created 2 million AUSD without backing. |
| 15:01:59 | A valid LayerZero message released 1.4 million AUSD from an Ethereum adapter, 153 seconds after the first transaction. |
| 15:03–15:05 | Reporting traced swaps of 1.4 million AUSD and about 1 million USDC into ETH through 1inch. |
| 15:06:47 | Initia’s incident notice referenced a LayerZero release of 105 ETH on Ethereum. |
| 15:41:30 | Initia halted its L1 and rollups. |
| Five seconds after the halt | An address linked to the exploit transferred about 1,135 ETH to another wallet. |
D2 Finance reported that the Ethereum outflows included 1.4 million AUSD, 105 ETH and about 1.08 million USDC, and said about $2.65 million had reached Ethereum within 7 minutes and 21 seconds of the initial transaction. 16 Other reporting put the consolidated amount at about 1,135 ETH, worth roughly $2.7 million at the time.
3
14 These are reported transaction and valuation figures, not a confirmed final loss total.
What Agora’s freeze did—and did not—mean
Agora, the issuer of AUSD, said it had no smart contracts deployed on Initia. Reporting also described the incident as involving a third-party product using AUSD, rather than an exploit of an Agora contract deployed on Initia. 17
40
Agora’s Ethereum AUSD contract froze an address identified as belonging to the attacker, but the reported AUSD had already been swapped for ETH. A successful address freeze therefore did not mean that the exchanged proceeds had been recovered. 17
What is known about holder risk
The incident involved reported withdrawals of assets from Ethereum-side bridge infrastructure after the attacker obtained unbacked balances on Initia. That raises questions about backing and exposure for bridged assets, but the available reports do not establish which holders ultimately bore losses or what the final amount was. 16
37
The incident should also be distinguished from an additional mint of native INIT: Initia said INIT was not minted and its total supply was unaffected. 37 That does not, by itself, establish the full financial impact on users or other assets.
Network response and what remained unresolved
Initia said it was coordinating with security teams, validators and exchanges while it assessed the incident. Upbit suspended INIT deposits and withdrawals. 15
39
Early coverage reported that Initia had not provided a restart date or confirmed final loss total at the time of publication. Those reports describe the status then; they do not establish whether the project later issued an update. 8
43
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How a MoveVM Flaw Led Initia to Halt Its L1 and Rollups"?
Initia halted its layer 1 network and connected rollups at 15:41:30 UTC on October 23, 2026, after an attacker moved assets valued at roughly $2.6–$2.7 million to Ethereum.