Initia attacker moves 1,135 ETH as chain halts

On Friday, an address tied to the Initia exploit sent about 1,135 ETH, worth more than $2.7 million, to a second Ethereum wallet. Initia halted both its Layer 1 and all its rollups at 15:41:30 UTC, five seconds before the transfer got settled.

Spreek, the onchain analyst, raised the alarm at 15:27 UTC. “Initia chain hacked and a bunch of tokens infiniminted. Hacker has cashed out $2.6m thus far with more in flight,” he wrote.

Agora froze the exploit address after 1.4 million AUSD left

Prior to the massive transfer, the same address exchanged 1.4 million AUSD and about 1 million USDC into ETH via 1inch. Both swaps happened between 15:03 and 15:05 UTC, more than 20 minutes before the first public alert.

Spreek said the attacker created bridgeable tokens on Initia without backing and bridged them back out, draining the bridge contract. “effectively means the AUSD and similar is unbacked on initia right now,” he said.

At 18:04 UTC, the receiving wallet still had the 1,135.5 ETH in it, and no outgoing transaction was registered. And the AUSD issuer Agora froze the attacker’s first address on Ethereum at 16:31:59 UTC.

The freeze came about after the swaps, and the address already had zero AUSD. Agora also said it “has no smart contracts deployed on Initia,” so its freeze only affects chains where AUSD contracts are deployed.

Upbit suspends INIT deposits and withdrawals pending checks

“As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident,” Initia said on X. Initia is working with security professionals and exchanges to figure out how bad the damage is.

Co-founder Ezaan Mangalji believes a newly discovered software flaw let the hacker create tokens and take out about $2.7 million. Initia’s server showed the last block, 23,365,925, was made at the moment of the shutdown.

The base chain manages bridging and liquidity for all Initia rollups. When it was stopped, transfers and trading on InitiaDEX froze for all users including the INIT holders.

Upbit said in its notice that it halted INIT deposits and withdrawals at 15:57 UTC, citing signs of the security incident on the network. Trading continues, and the exchange said it would resume transfers only once it was convinced deposits and withdrawals were stable.

INIT sank 14% at the time of exploit disclosure. The token then reversed the losses and was trading about 14% higher on the day as of 17:03 UTC.

On October 17, a Cysic attacker forged a mint message and withdrew 10 million unauthorized CYS from the bridge, according to Cryptopolitan. In August, Cryptopolitan reported on what appeared to be a 4 billion ONE mint on Harmony.