Initia L1 and rollups · Breach

Initia halts L1 and rollups after reported mint exploit

· 1 min read

Initia halted its L1 and rollups on October 23, 2026, per 0xCERT, after an incident in which an attacker reportedly minted tokens exploiting a MoveVM bug, affecting bridged assets. Analyst Spreek estimated $2.6 million cashed out, with stablecoin swaps and a later 1,135.5 ETH transfer on Ethereum, The Defiant reports. No fix or restart timeline appears in the sources; follow Initia's official notices.

WhatsApp LinkedIn X
HighBreachNo software to update
In this article
  1. What happened
  2. Why it matters
  3. What to do
  4. For the technical team
  5. Timeline
  6. Sources

What happened

Initia halted its L1 and rollups on October 23, 2026 after a security incident. An attacker reportedly minted tokens exploiting a MoveVM bug, affecting bridged assets.

Incidents like this, every morning

The ones that need action first, in a 3-minute read.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Why it matters

Analyst Spreek estimated $2.6 million was cashed out by the attacker, The Defiant reports. Bridged assets on Initia are affected, and the L1 and rollup halt stops operations on the network until restart.

What to do

Wait for Initia's official notices about the network restart. Review exposure to bridged assets on Initia and monitor the attacker's movements on Ethereum.

For the technical team

Affected
Initia L1 and rollups (MoveVM) · Initia L1 and rollups, with bridged assets involved (0xCERT). Versions not specified in the sources.
Exploitation
Exploitation reported by The Block and The Defiant: the attacker reportedly minted tokens. No public PoC or KEV listing cited in the sources.
Fix
No fix or patch cited in the sources; 0xCERT lists no patched versions. Await Initia's official notice about the restart.
Vector
Mint bug in Initia's MoveVM that reportedly let an attacker create tokens; bridged assets affected. The sources do not detail exploitation preconditions.
More details
Incident start on October 23, 2026 (0xCERT). The Defiant cites Ethereum records showing stablecoin swaps and a later 1,135.5 ETH transfer; analyst Spreek estimated $2.6 million cashed out.

Timeline

  1. Incident opened.

Sources 3 sources

Get the next one tomorrow morning

One email a day with what changed, what to fix first and how. After signing up you get the full feed.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Share it with your team

Whoever handles security with you should get it too.

LinkedIn X

Your colleague gets a confirmation request. Nothing is sent unless they confirm.

See all news

Read also

Before you go: get this every day

The HIFY Radar daily edition lands every morning with the incidents that need action. Free.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click