iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Initia halted its Layer 1 and rollups at 15:41:30 UTC on October 23, 2026, after an attacker reportedly exploited a previously unknown MoveVM bug to create unbacked token balances and redeem some of them for real assets through bridges. Preliminary reporting says native INIT was not affected. Bridge reserves released about $2.6 million to $2.7 million in AUSD-labeled assets, ETH and USDC before the pause, while the attacker’s Initia-side balances had a face value of $7.48 million. As of October 27, the network remained halted while a patch was being completed and audited; Initia had not announced a restart time or published a full post-mortem.
Why did Initia halt its network?
Initia said its L1 and rollups were halted because of a security incident. Preliminary findings reported by The Block and later technical analyses point to a flaw in MoveVM script caching, the mechanism that reuses compiled transaction code. According to a statement quoted by SigIntZero, malicious code could bypass security checks and spoof MoveVM state, crediting an account with unbacked WETH, iUSD and USDC representations without increasing the corresponding token supplies.
The precise cache key or validation defect has not been confirmed in a final Initia post-mortem. Technical descriptions should therefore be treated as reported findings, not a definitive root-cause statement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Was the native INIT token minted?
Initia co-founder Ezaan “Zon” Mangalji said the reported bug “does not apply to native INIT tokens.” The reported unauthorized issuance involved other assets and their bridge representations, not evidence that INIT’s native supply was increased.
Popular on Amazon
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
How did the reported exploit turn unbacked balances into real assets?
The attacker first created counterfeit balances on Initia, then used burn-and-bridge routes. LayerZero Ethereum adapters released assets when the forged representations were burned, and the Noble-Circle CCTP route produced USDC on Ethereum. D2 Finance, quoted by Unchained, noted that “an OFT adapter cannot check whether burned tokens were ever backed.” In other words, a bridge can verify a burn event without proving that the burned balance originated from legitimate collateral.
This is why a displayed token balance and a redeemable reserve are different things. The exploit did not need to drain every token holder directly; it needed to make bridge contracts accept fabricated supply as if it were backed.
What happened, and when?
| UTC time, October 23, 2026 | Reported event |
|---|---|
| 14:59:26 | D2 Finance’s transaction reconstruction places the first unbacked Initia-side mint. |
| 15:27 | Researcher Spreek publicly warned that Initia had been hacked and estimated about $2.6 million cashed out. |
| 15:41:30 | Initia announced that its L1 and rollups had been halted. |
| 15:41:35 | The proceeds wallet received approximately 1,135.52 ETH, according to the later reconstruction. |
Initia’s public notice urged users to rely on verified official channels and avoid unofficial claims. The five-second gap between the halt announcement and the proceeds-wallet transfer appears in the reconstruction, but it does not by itself establish whether that transfer was a final exploit step, consolidation, or another transaction in the response window.
Recommended Free Tools
How much was stolen, and why do the numbers differ?
The figures describe different things and should not be combined into one loss number.
Also popular on Amazon
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
| Figure | What it measures | Source and qualification |
|---|---|---|
| $7.48 million | Face value of tokens created on Initia | Bitquery Research, 2026; one account reportedly printed this amount in 13 seconds. |
| $2.73 million | Real assets released from bridge reserves | Bitquery Research, 2026. |
| About $2.6 million to $2.7 million | Estimated value bridged out | Initia co-founder Zon and incident reports; early estimates omitted a second USDC tranche. |
| Approximately 1.4 million AUSD, 105 ETH and 1.08 million USDC | Assets released to Ethereum | D2 Finance reconstruction relayed by 0xCERT and Unchained. |
| 1,135.52 ETH | ETH later consolidated in the proceeds wallet | D2 Finance and SigIntZero reconstruction. |
| 99.99% | Low point for Noble’s USDC reserve | Bitquery reported a fall from $1.09 million to $63. |
| 55 withdrawals | Normal USDC withdrawals that bounced before the halt | Bitquery Research, 2026. |
The $7.48 million total is nominal value represented in Initia accounts. The approximately $2.7 million estimate is the value of genuine assets that bridge reserves paid out on Ethereum. A larger printed balance does not mean the same amount of real collateral was lost.
Was AUSD itself hacked?
Agora said its canonical AUSD was fully backed and that it had no smart contracts deployed on Initia. The affected asset was reported as a third-party LayerZero representation backed by an Ethereum lockbox, not canonical AUSD minted on Initia.
Reports use varying labels, including AUSD, AUSD0 and other descriptions of the mirrored token. Check the contract address and issuing bridge, rather than assuming that every asset carrying an AUSD label is the canonical Ethereum asset.
Is Initia back online?
Not according to the latest dated status available on October 27, 2026. Public analysis said the L1 and rollups remained halted while Initia completed and audited a patch and worked with security partners on recovery. Initia had not published a restart date or a complete post-mortem, so any claim that normal transfers or bridging have resumed should be verified against an official announcement.
Also popular on Amazon
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
What should users do with assets on Initia?
Until Initia publishes verified recovery instructions, treat the network as incident-restricted.
- Do not bridge assets to or from Initia or its rollups while the halt and recovery status are unresolved.
- Do not sign “refund,” “recovery,” emergency migration or claim transactions from links shared in chats or social-media replies.
- Use only Initia’s verified communication channels and independently check the domain and account before connecting a wallet.
- Keep transaction hashes, wallet addresses and screenshots if you need to support a later recovery or compliance inquiry.
- Review token contract addresses carefully; a familiar ticker can represent a third-party bridge asset rather than canonical collateral.
What a hardware wallet can and cannot protect
A hardware wallet can keep private keys isolated, require confirmation on the device and reduce exposure to phishing pages. It cannot stop a vulnerable virtual machine from creating unbacked balances, and it cannot prevent a bridge from releasing reserves after accepting a forged burn. Key protection and protocol solvency are separate controls.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What safeguards would address this failure mode?
The incident illustrates three distinct security layers:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Wallet-level control: hardware wallets protect the signer’s key and transaction approval process.
- Protocol-level validation: the VM must validate script identity and state transitions, enforce supply invariants and reject unauthorized mint paths.
- Bridge-level containment: adapters need limits, anomaly monitoring and circuit breakers that can pause releases when mint, burn or reserve patterns change abruptly.
Monitoring can shorten the time between an exploit and a halt, but it cannot restore reserves already released. A pre-authorized pause can stop later withdrawals; it does not reverse earlier Ethereum settlements.
Also popular on Amazon
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Frequently Asked Questions
Can I still view my Initia balance while the chain is halted?
Wallet interfaces may continue showing the last indexed state, but a displayed balance is not proof that it can currently be transferred or redeemed. Treat explorers and portfolio screens as historical information until Initia confirms service restoration.
What does “unbacked” mean in this incident?
It means the Initia ledger credited tokens without a matching increase in the underlying token supply or reserve. Those entries could look legitimate inside the chain even though the bridge’s collateral was not created for them.
Could a bridge exploit affect Ethereum users who never used Initia?
Yes, if a bridge adapter releases Ethereum assets against forged representations from another chain. The affected reserve is the bridge’s pool or lockbox, so Ethereum-side holders can face price or liquidity effects even without an Initia transaction.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What evidence should I preserve before contacting support?
Save the wallet address, chain ID, token contract address, transaction hash, timestamps and the exact official announcement you followed. Do not send private keys or seed phrases; legitimate incident response does not require them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
