Initia had to stop its blockchain after an attacker minted 2 million tokens: what happened and why a halt is so controversial

What happened to Initia? The blockchain stopped. At 3:41:30 p.m. UTC on 23 October, Initia halted its layer 1 network and all connected rollups after a security incident that reportedly let an attacker create tokens out of thin air and move millions of dollars of assets to Ethereum, as reported by Cointrust. The team said it was working with security researchers, validators and exchanges to assess the damage.

The dollar loss, estimated by outside observers at around 2.7 million dollars, is small by the standards of this year's crypto hacks. The decision to halt an entire blockchain is not. It reopens one of crypto's oldest arguments: should a network that promises to be decentralised and unstoppable be able to stop itself when something goes wrong?

How the exploit reportedly worked

According to an account from decentralised finance platform D2 Finance, the attacker exploited a vulnerability to create 2 million AUSD tokens without sufficient backing, then used cross chain transfers to move about 1.4 million AUSD, 105 ether and 1.08 million USDC to Ethereum. The assets were consolidated into an Ethereum wallet holding about 1,135.5 ether, worth around 2.73 million dollars, after stablecoins were swapped.

Blockchain security researcher Spreek first flagged the incident, reporting that an attacker had minted tokens without authorisation and converted about 2.6 million dollars in assets, with more funds moving as the investigation developed. These figures are estimates from external observers rather than a final assessment from Initia.

Preliminary findings attributed to Initia co founder Ezaan Mangalji, known as Zon, pointed to a previously unknown vulnerability in the network's MoveVM implementation operating with the Cosmos SDK. A zero day vulnerability is one that was not known or patched before it was exploited, which means ordinary audits and monitoring may not have caught it.

The AUSD dispute

The incident quickly raised questions about the stablecoin involved. Agora, the issuer associated with AUSD, disputed accounts linking the unauthorised minting directly to its infrastructure on Initia, saying it did not have smart contracts deployed on the network. That raises the question of exactly which components allowed the tokens to be created.

Agora also set out the limits of what it can do. It said its response would focus on hacker addresses holding AUSD on blockchains where its own smart contracts are deployed, because freezing tokens through an issuer controlled contract is very different from stopping transactions on another blockchain or recovering assets already moved elsewhere.

In a cross chain world, a token can be minted on one network, swapped on another and parked on a third before anyone agrees whose problem it is.

That fragmentation is a growing challenge for the industry. Bridges and cross chain transfers, which HSBC avoided by keeping its new RedCoin stablecoin on a private ledger, as we noted in our report on RedCoin's design, let attackers move value quickly across networks with different rules, issuers and security models, complicating both detection and recovery.

Why halting a blockchain is controversial

Halting the network almost certainly limited the damage, by stopping the attacker from minting or moving more assets on Initia. Validators and exchanges coordinating to pause activity is a standard incident response for smaller networks, and many users will welcome it.

But it also exposes how much control a project team and its validators retain. Critics argue that a blockchain that can be stopped is less decentralised than it claims, and that the power to halt could in principle be used for other reasons. Supporters counter that early stage networks need emergency brakes until they mature. The core trade offs include:

• Halting protects users from further losses but pauses all activity on the network
• Coordinated halts show concentrated control among validators and teams
• Restarting may require patches, state rollbacks or decisions about stolen funds
• Cross chain assets moved off the network cannot be recovered by a halt
• Transparency during the incident is critical for restoring trust

What it means for crypto investors in Asia

For investors, the Initia incident is a reminder that newer blockchains carry smart contract and protocol risks that established networks have had longer to test. Zero day vulnerabilities in core components, rather than individual applications, are especially dangerous because they affect everything built on top.

The broader security picture this year has been grim, with state linked hackers stealing large sums across the industry, as we covered in our report on North Korea's crypto thefts passing 1 billion dollars. Asian exchanges that list tokens from newer networks will face pressure to assess protocol level risks, not only market demand.

The next steps for Initia are a full post mortem, a patch for the vulnerability and a decision on how and when to restart. How the team handles losses and communicates with users will determine whether confidence returns.

Initia's halt shows how quickly a single flaw in core blockchain code can turn into a cross chain loss that no single party can easily reverse. Stopping the network likely limited the damage, but it also revived hard questions about how decentralised newer blockchains really are. For investors, protocol level risk deserves as much attention as price.