Show
Initia, a blockchain platform, halted its Layer 1 (L1) blockchain and rollups following a security incident on October 23, 2026. Security researcher Spreek reported that an attacker had minted tokens without permission and cashed out about $2.6 million.
The platform said it was investigating the incident with security teams, validators, and exchanges. However, Initia has not confirmed the reported losses or identified the cause of the incident. “Our team is actively investigating the situation and working to establish the full scope of any impact with security teams, validators, and exchanges,” the team said in a post on X.
The project announced the halt at 15:41:30 UTC, saying it was working to determine what happened and assess the extent of the impact. While the network stoppage is confirmed, Initia has not verified the reported amount stolen or explained how the attacker may have gained the ability to create tokens without approval.
Spreek reports $2.6 million cashed out
In a post on X, Spreek wrote, “Initia chain hacked and a bunch of tokens infiniminted. Hacker has cashed out $2.6m thus far with more in flight.”
The researcher also identified an Ethereum wallet, 0xDD922c841d85E12dac2dc2eef5a5E29cFFf6edFA, and an associated contract, 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E.
The claim points to a possible exploit in which unauthorized token creation allowed the attacker to obtain assets through connected infrastructure. Spreek also said more funds were in transit, but did not specify their destination or the potential amount involved.
D2 Finance traces how the exploit moved the funds
Blockchain research account D2 Finance later published a technical breakdown of the incident, saying it had decoded the exploit and traced how the attacker moved funds from Initia to Ethereum. According to D2 Finance, a signed transaction at 14:59:26 UTC created 2 million AUSD tokens without backing. The account said that 153 seconds later, a valid message through LayerZero released 1.4 million real AUSD from an Ethereum adapter.
D2 Finance reported that approximately $2.65 million had reached Ethereum within seven minutes and 21 seconds of the initial mint.
The account said the withdrawals consumed about 71% of the AUSD adapter’s balance and 96% of the native-ETH adapter’s balance. It also reported that the funds were converted into ETH through decentralized trading platforms 1inch and 0x.
D2 Finance said the wallet’s activity began hours before the token mint. According to its account, the wallet received 0.1 ETH from Tornado Cash at 08:27 UTC and made small transfers through AxelarHandler from 13:14 UTC. At 14:37 UTC, it reportedly deposited 0.006 ETH into the same ETH adapter that was later emptied.
The research account said 1,135.52 ETH, worth approximately $2.73 million, had been moved to a newly created wallet identified as 0x358e…CAC8.
These figures are D2 Finance’s on-chain analysis and have not been independently confirmed by Initia.
How D2 Finance says the exploit worked
D2 Finance said the initial mint involved the attacker’s own key calling a Move function on Initia, rather than a bridge message. It argued that this allowed the attacker to create tokens on Initia and then use the connected bridge system to withdraw real assets from Ethereum.
The account explained that LayerZero’s Decentralized Verifier Networks (DVNs) confirmed burns that had actually taken place. However, an Ethereum OFT adapter could not determine whether the tokens burned on Initia had been properly backed. As a result, the Ethereum adapter could release real assets even if the original tokens had been created through a flaw on Initia.
D2 Finance compared the incident with the September 6 Liquid exploit, where a software bug reportedly created 4,000 L-BTC and a withdrawal process released 3,996 real Bitcoin.
Initia warns users as AUSD issuer Agora responds
Initia has urged users to exercise caution while the investigation continues. The project warned against unofficial links, messages, and claims circulating online, saying it would share verified information through its official channels.
Agora, the issuer of AUSD, also said it was aware of the security incident on Initia. The company said it has no smart contracts deployed on Initia, while its security team has been monitoring the situation. Agora added that it would freeze funds linked to hacker addresses holding AUSD on networks where its AUSD and Agora smart contracts are deployed.
Agora’s response does not independently confirm D2 Finance’s technical findings or the total amount lost. Those details remain attributed to the research account while Initia investigates.
Other crypto exploits add to security concerns
The Initia incident follows several other reported security breaches across the crypto industry.
Pirate Chain recently told its community that upgrading to version 6.0.14 was mandatory following an October 14 exploit involving about $39.8 million in counterfeit coins.
NEAR Intents also faced a security incident that led to nearly $3.8 million being withdrawn between September 29 and October 1.
Another incident affected Slice, an on-chain commerce protocol running on Base. A flaw in its FundsModule contract allowed an attacker to take approximately $41,000 in Ether (ETH) and USD Coin (USDC). The contract paid out from pooled funds based on amounts reported by other contracts, even though those contracts had not sent any assets.
Blockchain security firm CertiK reported that confirmed security incidents in August 2026 caused about $215 million in losses, including $144.6 million from decentralized finance. Around $110.7 million was later classified as returned or frozen.
For Initia, the immediate task is to establish how the incident occurred, which parts of its network were affected and the extent of any losses. Until the investigation produces verified findings, the reported $2.6 million cash-out and unauthorized token creation remain claims from security researchers rather than confirmed figures from Initia.
Also Read: WazirX Hack Victims Can’t Cash a Single Recovery Token; Nischal Shetty Says Trust Is Back