A chain can stop at the flick of a switch: reviewing how unlimited minting on Initia led to $2.7 million being drained
Last Friday afternoon, a public blockchain hit the pause button. Initia announced on its official account that, due to a security incident, its mainnet and the Rollups built on it had all halted as of 15:41:30 UTC on October 23. The chain stopped at block 23365925, with no new blocks produced afterward. Even those who weren’t robbed were affected: deposits, swaps, and transfers between Rollups were frozen, leaving tokens on the books immovable. The amount lost is only part of the story; the chain grinding to a halt was itself an incident.
The attack was not especially complicated. Security researcher Spreek was the first to sound the alarm publicly, saying that someone had created tokens out of thin air and already converted nearly $2.6 million into other assets. Initia co-founder Ezaan Mangalji then offered an initial assessment: a Day 0 flaw, present in the MoveVM execution environment since launch, allowed the attacker to bypass minting limits and issue additional tokens directly on the mainnet. On-chain tracking by D2 Finance filled in what happened next: the attacker created around 2 million AUSD-like tokens with no genuine collateral backing, moved them across a bridge to Ethereum, and consolidated the proceeds in one wallet—about 1,135.5 ETH, worth roughly $2.73 million at the time. The transaction used just 135,888 units of gas and directly called a Move function. The bridge’s security checks were not breached; the vulnerability was in the minting step.
Three points need to be kept distinct. First, the $2.7 million figure is an initial estimate from the co-founder, combined with D2 Finance’s on-chain tally. The project has not yet announced a final confirmed loss total or a restart time, so treating that preliminary figure as definitive would be premature. Second, the co-founder explicitly said this flaw did not affect the native INIT token. The stolen value came from assets obtained by swapping the newly minted tokens. Seeing the name INIT and claiming that the native token was inflated is simply a case of mistaken identity. Third, Agora, the issuer behind AUSD, specifically clarified that it had not deployed any contracts on Initia. AUSD on other chains continued to operate normally and remained fully collateralized. So saying that the AUSD issuer’s contract was compromised is also wrong.
Exchanges moved quickly. Upbit suspended INIT deposits and withdrawals at 15:57 on October 23, while trading on the platform continued as usual. Only 16 minutes passed between the chain halting and a major exchange suspending deposits. News spread far faster than anyone could react manually. INIT first fell by about 14% that day. The market’s initial reaction was fear, but what often determines whether you lose money is whether you can move your assets at that moment.
This incident offers retail investors three practical takeaways. A chain halt is a risk in its own right: tokens not being stolen does not mean you can move them. Keeping some funds in a wallet you control is more reassuring than putting everything into the ecosystem of a single chain. Minting limits and collateral backing are two of the most important questions to ask about a project: Can more tokens be created out of thin air, and is there anything real backing what gets minted? If a project cannot clearly answer those questions, even a smooth bridge may simply help turn freshly minted tokens into cash faster. And treat any supposed recovery or refund announcements on the day of an incident with skepticism by default. Initia itself warned users in its announcement to beware of unofficial links. During an outage, shortcuts that suddenly appear are very often aimed at people in a hurry.
My view is straightforward: the lesson here is not how large the $2.7 million figure is, but that a flaw in one part of the minting process can take a chain from normal operation to a network-wide freeze in 16 minutes. Retail investors cannot defend against a Day 0 flaw, but they can avoid putting their entire net worth in one place, and they can avoid clicking random links during an outage. When evaluating a project, ask one more question: can this token be minted in unlimited quantities? Asking it before an incident costs the least.
Have you ever experienced a chain going down, an exchange suspending deposits, or tokens that were clearly in your account but couldn’t be withdrawn? How did you handle it?
#Initia #链上安全 #被黑复盘 #跨链桥 #WalletSecurity
—— Web3 Investor Kai
This post is solely an incident review and personal opinion, and is not investment advice. The amounts mentioned are based on public reporting and the project team’s preliminary statements; the final loss will depend on the official confirmed findings.