Layer 1 Halted After $2.7M Token Mint Exploit

A Layer 1 blockchain and its connected rollups were forced to suspend operations on October 23, 2026, following a multi-million-dollar security breach. The network, Initia, paused all block production at exactly 15:41:30 UTC after developers discovered a critical vulnerability resulting in the unauthorized minting of tokens.

Phantom Token Generation

The attack began with a single signed transaction at 14:59:26 UTC that consumed 135,888 gas. This transaction allowed the attacker to generate 2 million unbacked AUSD tokens out of thin air on the network.

DeFi platform experts at D2 Finance noted the speed of the operation, stating: "We decoded the @initia exploit. One signed tx at 14:59:26 UTC minted 2,000,000 AUSD out of nothing. 153 seconds later a valid @LayerZero_Core message released 1.4M real AUSD from the Ethereum adapter. $2.65M was back on Ethereum within 7m21s of the mint."

Beyond the AUSD incident, the exploiter systematically drained other assets. They withdrew 105 ETH from a native-ETH adapter and utilized Circle's Cross-Chain Transfer Protocol (CCTP) to mint an additional 1.08 million USDC. In total, the attack severely depleted the protocol's reserves, taking 96% of the balance from the network's ETH adapter and 71% from its AUSD adapter. The stolen funds were eventually consolidated into a single cryptocurrency wallet holding 1,135.52 ETH, which carries an approximate value of $2.73 million.

Network Suspension and Response

Following the breach, the official Initia project account announced the emergency pause on social media. "As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident. Our team is actively investigating the situation and working to establish the full scope of any impact with security teams, validators, and exchanges," the project stated.

Initia co-founder zon, operating under the handle @ItsAlwaysZonny, provided initial technical details, pointing to a severe underlying vulnerability. "to the best of our knowledge so far, this is a Day 0 bug related to Initia's MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens. the attacker was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused," the co-founder explained.

The incident caused immediate turbulence in the secondary markets. The network's native INIT token initially dropped by roughly 14% before recovering with an 11.7% increase, trading at $0.1484. In response to the event, cryptocurrency exchanges Upbit and Bithumb labeled INIT as a "trading-caution asset," effectively flagging it as high risk, and suspended both deposits and withdrawals on October 26, 2026.

Meanwhile, stablecoin issuer Agora pushed back on the specifics of the incident. The firm disputed the initial exploit reports, asserting that it operates no contracts on the affected network and maintaining that no actual AUSD was minted during the attack.