Initia hack explained: how $2.6M was cashed out

On October 23, 2026, the Initia blockchain and all of its rollups were halted after an exploit: according to researcher Spreek, an attacker gained the ability to mint tokens without limit and swapped them for real assets. Spreek estimates about $2.6 million was cashed out, and nearly all of it now sits in one place — 1,135.5 ETH at a single Ethereum address. The project has not confirmed the loss.

What we know now

• Initia L1 and its rollups are paused; transfers and trading on the network are stopped. The team is working with security firms, validators and exchanges to assess the scope (PANews).
• The cash-out estimate is about $2.6 million (Spreek, via The Block). There is no official figure and no technical write-up yet.
• The proceeds — 1,135.5 ETH, roughly $2.7 million — sit at 0x358eF0…CAC8. As of 1:20 PM ET they had not moved.
• South Korean exchanges Upbit and Bithumb suspended INIT deposits and withdrawals and issued an investor warning (PANews).
• No restart date has been given.

How it happened

Spreek called it an "infinimint": the attacker obtained the ability to mint tokens on Initia with no cap, then swapped them for assets with real market value (Crypto Briefing). The team has not said which bug made this possible.

Initia is a modular layer-1 built on the Cosmos SDK, with a family of connected rollups running MoveVM and EVM. Crypto Briefing notes that this design creates many places where minting permissions and cross-chain transfers are defined — and therefore many potential points of failure.

The playbook in such attacks is simple: if you can print a token that some venue accepts as collateral or as a trading pair, you mint a huge amount and immediately swap it for something that trades outside the chain, such as stablecoins and ETH. Halting the whole network is meant to close the hole before more can be drained.

Timeline

Oct 23, 9:14 AM ET. The address later used for the swaps (0xDD922c…edFA) starts sending transactions on Ethereum, per the Blockscout block explorer.

Oct 23, 11:01⁠–⁠11:26 AM ET. The address receives 1.4 million AUSD and about 1.08 million USDC, which are swapped into ETH through the 1inch and 0x aggregators (Blockscout).

Oct 23, 11:41 AM ET. A single transaction moves 1,135.5 ETH to 0x358eF0130f7A5aA516dCd81Bdc80B18CdE41CAC8. Right afterward, look-alike addresses with matching first characters start sending transfers around the wallets — what appears to be a typical address-poisoning attempt.

Oct 23, before 1:00 PM ET. Spreek flags an unlimited-mint exploit and estimates $2.6 million cashed out, with more funds still moving. Initia halts L1 and its rollups (Phemex News, citing The Defiant).

Oct 23, 1:03 PM ET. The Block publishes the first detailed report. Initia says it is investigating the reach of the incident alongside security teams, validators and exchanges, and warns users not to trust unofficial links and messages.

Oct 23, afternoon ET. Upbit cites a "suspected security issue on the Initia chain," pauses INIT deposits and withdrawals and warns of higher volatility, noting that trading and the listing are not affected (Cryptonews). Bithumb does the same (PANews).

Where the money went

On Ethereum the trail is still short. About $2.48 million in stablecoins (1.4 million AUSD plus roughly $1 million and $80,000 in USDC) was swapped into ETH, and the 1,135.5 ETH was consolidated at one address. Per Blockscout, as of 1:20 PM ET all of that ETH was still there — nothing had gone to mixers, bridges or exchanges. The Defiant describes the same flow: stablecoin swaps followed by a 1,135.5 ETH transfer.

How many minted tokens remain on Initia itself, and whether the attacker moved anything out through other chains, has not been disclosed.

What the team and exchanges did

• Initia halted L1 and all rollups and is working with security firms, validators and exchanges. It says verified information will be shared only through official channels (PANews). No post-mortem, bounty offer or message to the attacker so far.
• Upbit paused INIT deposits and withdrawals and added the token to its warning list. Service resumes after transaction security is verified; no date given.
• Bithumb also paused INIT deposits and withdrawals.
• As of publication we found no statements on the case from Binance, PeckShield, CertiK, Cyvers, SlowMist or ZachXBT.

What it means for holders

While the chain is down, tokens cannot be moved on Initia, and INIT cannot be deposited to or withdrawn from Upbit and Bithumb. INIT keeps trading on exchanges. Per The Block, the token fell about 14% on the first reports of the exploit and then recovered to trade about 14% higher on the day.

The key open questions: which tokens were minted and how many are still in circulation, whether there will be a chain rollback or compensation for affected pools, and how soon the network restarts. Crypto Briefing notes that Initia launched mainnet in 2025, raised about $24 million from backers including Binance Labs and Delphi Digital, and went through several audits; in 2025 the chain also had a staking-reward misconfiguration, fixed through governance.

Scammers typically push fake "compensation" and "migration" links during incidents like this; Initia explicitly asks users to trust only its official channels. Live prices are in the daily brief; more exploits are covered in our Q3 hacks review and the Qubic hack timeline.

This is not investment advice.

---

This story is developing: we are following events and adding new information as it emerges. Last updated Oct 23, 2026, 1:40 PM ET.