The layer-1 network and all of its rollups stopped at 15:41 UTC on Friday. A security researcher and a co-founder put the amount taken at about $2.6 million to $2.7 million. Initia has not confirmed a loss figure, and Upbit paused deposits and withdrawals.
Initia, a Cosmos-based blockchain built around linked rollups, stopped its entire network on Friday after a security breach.
"As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident," the project said in a post on X. Its team is investigating with security teams, validators and exchanges.
What the chain shows
On-chain researchers traced the attack to a flaw that let tokens be created without sufficient backing. Analytics firm D2 Finance identified a transaction at 14:59:26 UTC that minted about 2 million AUSD, a stablecoin on the network, without enough collateral behind it, and said the attacker also obtained about 1.08 million USDC. The proceeds were converted into about 1,135.5 ether, worth roughly $2.7 million, and consolidated in a single Ethereum address.
Security researcher Spreek initially estimated that about $2.6 million was cashed out, with more funds still moving. Initia co-founder Zon put the total at about $2.7 million across AUSD, ether and USDC. Initia has not confirmed the amount lost.
South Korean exchange Upbit suspended INIT deposits and withdrawals, citing a suspected security issue.
The root cause, whether user balances or the INIT token's supply were affected, and when the chain will restart have not been disclosed.
The off switch
The dollar loss is modest by the standards of this year's largest hacks. What makes the incident notable is the response. Stopping a layer-1 network and every rollup built on it freezes all user activity, a step typically possible only when a relatively small group of validators and developers can coordinate a halt.
Supporters will call that responsible containment. Critics will say it shows how centralized the network's operations remain, since a fully decentralized chain would have no easy way to stop.
It is also the second unauthorized-minting incident in about a week. In the Cysic exploit on Oct. 17, an attacker later sent about $744,000 of ether and BNB to the Tornado Cash mixer after a bounty offer.
Contained or deeper
One reading is that this is a small, contained exploit, halted about 40 minutes after the minting transaction and limited to a few million dollars.
Another is that the flaw could sit in shared infrastructure. Some analysts have speculated about the network's virtual machine, which could matter for other projects that use similar technology, though Initia has not identified a cause.
What to watch
Initia's post-mortem and restart plan, any recovery of funds, and whether other exchanges restrict INIT trading.