Protocols & Policy · Breaking
Initia co-founder blames software bug for halted chain
Zon, who describes himself as an Initia co-founder, says a bug let an attacker create extra tokens and move about $2.7 million off the network. The chain was still stopped at 12:55 p.m. ET.
A software bug let an attacker create extra tokens on Initia's main blockchain and move about $2.7 million off it, according to Zon, who describes himself on X as an Initia co-founder [1]. Initia's chain and the networks built on it have been stopped since 11:41 a.m. ET [2][3].
"[T]o the best of our knowledge so far, this is a Day 0 bug related to Initia's MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens," Zon wrote at 12:22 p.m. ET, quoting Initia's own halt statement [1][2]. MoveVM is the software engine that runs programs on Initia's chain. A "Day 0" bug is one nobody knew about before it was used. To mint is to create new tokens.
Zon put the amount the attacker minted and bridged out at about $2.7 million in AUSD, ETH and USDC [1]; Agora, the AUSD issuer, said no AUSD was minted on Initia [5]. Bridging out means moving tokens from one blockchain to another, here off Initia. Initia itself has not published a full account of what happened.
Le Coin checked Initia's public data feed at 12:55 p.m. ET. The latest block was still number 23365925, stamped 11:41:30 a.m. ET, so the chain had produced no new blocks for about 74 minutes [3].
Upbit, a South Korean exchange, posted a caution notice on INIT, Initia's token, at 12:15:01 p.m. ET [4]. It said signs of a suspected security problem on the Initia chain had been found and urged holders to take particular care when trading, linking to Initia's statement (Le Coin translation). The notice is a caution only.
Sources
- Zon (@ItsAlwaysZonny), post on X, Oct. 23, 2026, 12:22 p.m. ET, https://x.com/ItsAlwaysZonny/status/2113667290059190466, accessed Oct. 23, 2026, 12:47 p.m. ET.
- Initia (@initia), statement on X, Oct. 23, 2026, 12:00 p.m. ET, https://x.com/initia/status/2113661738625155217, accessed Oct. 23, 2026, 12:47 p.m. ET.
- Initia public RPC endpoint, node status, latest block (chain interwoven-1), https://rpc.initia.xyz/status, accessed Oct. 23, 2026, 12:55 p.m. ET.
- Upbit, notice 6699, "이니시아(INIT) 유의 촉구 안내" (INIT caution notice), Oct. 24, 2026, 01:15:01 KST (12:15:01 p.m. ET Oct. 23), https://upbit.com/service_center/notice?id=6699, accessed Oct. 23, 2026, 12:47 p.m. ET.
- Agora (@withAUSD), reply on X, Oct. 23, 2026, 1:17 p.m. ET, https://x.com/withAUSD/status/2113681155585368432, accessed Oct. 23, 2026, 1:50 p.m. ET.
Holding the Corner.
Not financial advice.