An attacker exploited a software vulnerability in Initia to mint unbacked tokens and extract $2.7 million in ETH, moving the stolen funds to a second wallet five seconds before the network halted to contain the breach. Institutional investors face renewed pressure to demand formal security audits and issuer-backed guarantees on cross-chain bridges, a pattern repeating across layer 1 and layer 2 networks.

• Attacker created unbacked bridgeable tokens, then swapped 1.4 million AUSD and about 1 million USDC into 1,135 ETH via 1inch decentralized exchange.
• Initia halted its layer 1 and all rollups at 15:41:30 UTC on Friday (October 23, 2026), five seconds before the attacker’s transfer of stolen ETH to a second wallet settled.
• Token issuer Agora froze the attacker’s first address on Ethereum at 16:31:59 UTC, but the receiving wallet with 1,135.5 ETH remained active and unrecovered as of 18:04 UTC.

• $2.7M in ETH extracted in a single exploit targeting cross-chain bridge reserves
• 1.4M AUSD tokens minted without backing on Initia’s layer 1 network
• 20 min elapsed between token swaps and public alert from onchain analyst

An attacker exploited a newly discovered software flaw in Initia, a multi-chain platform offering a layer 1 network and multiple rollups for scaling, to forge tokens and drain its bridge reserves, according to reporting by Cryptopolitan. Between 15:03 and 15:05 UTC on Friday, the attacker exchanged 1.4 million AUSD (a stablecoin issued by Agora) and approximately 1 million USDC through 1inch, a decentralized exchange aggregator, converting the unauthorized tokens into 1,135 ETH worth $2.7 million. Onchain analyst Spreek detected the breach at 15:27 UTC and alerted the community, writing that the hacker “created bridgeable tokens on Initia without backing and bridged them back out, draining the bridge contract.”

Initia halted networks five seconds after attacker moved stolen funds offchain

At 15:41:30 UTC, Initia shut down its layer 1 network and all rollups, according to a post on X, preventing further transactions across its ecosystem. The halt occurred five seconds before the attacker’s transfer of 1,135.5 ETH to a second Ethereum wallet settled. Initia’s layer 1 serves as the base chain managing bridging and liquidity for all its rollups; when it stopped, trading on InitiaDEX froze for all users, including INIT token holders. Co-founder Ezaan Mangalji attributed the breach to a software vulnerability that allowed the attacker to mint tokens without reserve backing.

The attacker’s timing proved critical. More than 20 minutes elapsed between the initial swaps at 15:03-15:05 UTC and Spreek’s public alert at 15:27 UTC, providing a window for the stolen ETH to reach a receiving address before the network halt. As of 18:04 UTC, the receiving wallet still held the full 1,135.5 ETH, with no outgoing transaction recorded.

Agora froze first address after funds already moved to second wallet

Token issuer Agora froze the attacker’s initial address on Ethereum at 16:31:59 UTC, about 87 to 89 minutes after the swaps occurred, but the freeze came too late, as the address had already transferred its remaining balance.

The freeze affected only Ethereum, where Agora’s AUSD stablecoin contracts are deployed; Agora confirmed it has no smart contracts on Initia, limiting the effectiveness of any freeze in containing the breach on the originating chain. The attacker’s first address had zero AUSD remaining at the time of the freeze.

South Korean exchange Upbit suspended INIT deposits and withdrawals at 15:57 UTC, citing the security incident. Upbit said it would resume transfers only after confirming stability of the network’s deposit and withdrawal systems.

INIT token volatility reflected market uncertainty: the token fell 14% following initial exploit disclosure, then reversed to trade approximately 14% higher on the day by 17:03 UTC.

Repeated bridge exploits signal gap in cross-chain security standards

The Initia breach follows a pattern of bridge-focused attacks across multiple networks. On October 17, 2026, a Cysic attacker forged a mint message and withdrew 10 million unauthorized CYS tokens from that protocol’s bridge. In August, a suspected 4 billion ONE token mint occurred on the Harmony network through similar unbacked token generation.

Each incident exploits the trust model underlying cross-chain bridges: they rely on issuer or validator attestation to confirm that tokens minted on one chain are backed by reserves on another.

Institutional investors have begun demanding formal security audits and reserve verification before committing capital to bridge-dependent protocols. Unlike traditional finance, where custodians face regulatory capital requirements and periodic third-party audits, many layer 1 and layer 2 networks lack mandatory pre-launch security assessments for new bridging mechanisms.

Initia’s halt demonstrates that even discovering a vulnerability can trigger cascading losses if the flaw permits unbounded token minting before detection occurs.

The CCS read. We see bridge exploits as a liquidity structure question for fund managers, not merely a token risk. When a protocol’s reserve backing becomes unverifiable mid-incident, stablecoin collateral and ETH locked in the bridge become illiquid or unrecoverable. Institutional investors must treat bridge security audits as non-negotiable gating requirements before allocation, matching the discipline applied to issuer-free layer 2 designs.

Initia has not yet disclosed whether the attacker’s second wallet will be traceable through exchange or mixer deposits, nor has it announced whether affected token holders will receive compensation from a recovery fund or protocol treasury. The open question remains whether regulatory pressure, particularly on Upbit and other regulated exchanges, will force blanket INIT token delisting until Initia completes a full security review and publishes audited reserve verification for all bridged assets.