← The Polylog Crypto Intelligence Brief
Morning Edition · Saturday, October 24, 2026Published at 1:47 AM EDT · New York
Initia Halts Its Blockchain After a MoveVM Bug Lets an Attacker Mint Unbacked Tokens and Move $2.6 Million to Ethereum
The incident came days after Pirate Chain rolled back its ledger to erase 39.8 million counterfeit tokens, the second chain this month to stop or rewrite history over a protocol-level minting flaw.
Initia halted its layer-1 blockchain and connected rollups on Oct. 23. Security researcher Spreek reported that an attacker had minted tokens without authorization and cashed out about $2.6 million. Initia's statement said the suspension took effect at 3:41:30 p.m. that day. Bitcoin.com put the figure at about $2.7 million.
Ezaan Mangalji, an Initia co-founder, said preliminary findings point to a previously unknown bug in the network's MoveVM implementation, which runs on the Cosmos software development kit (SDK), according to Cointelegraph. He said the flaw did not affect INIT, the native token. The attack vector was an unauthorized mint at the virtual-machine level, not a bug in an application contract. D2 Finance, a decentralized finance (DeFi) platform, reported that the attacker minted 2 million AUSD tokens with no backing. The attacker then used cross-chain transfers to move about 1.4 million AUSD, 105 ether (ETH) and 1.08 million USDC to Ethereum. No recovery, freeze or attribution had been announced at publication.
The unbacked mint only became a real loss when the bridge accepted it. FinanceFeeds noted that once newly created assets can be swapped or bridged for properly backed ones, an accounting error becomes economic extraction.
Pirate Chain, a privacy-focused network, went through the same kind of failure. On Oct. 14, attackers used two failed validation checks to mint about 39.8 million ARRR, roughly 20% of supply. One check let them bypass the minting limit, and the other parsed output scripts incorrectly. Reports tied the flaw to Ironwood, an upgrade activated on Oct. 3. The project rolled the chain back to block 4,176,944 and on Oct. 22 shipped a mandatory v6.0.14 release that rejects the compromised blocks. Some headlines described the figure as $39.8 million, but 39.8 million is the number of counterfeit tokens, not a dollar loss.
What this means
In both cases the failure sat in the chain's own issuance logic, where an audit of application contracts would not look. In both cases the remedy was a coordinated stop or rollback by a small set of operators. That fixes the immediate loss, but it shows that the ledger's history is final only as long as the core team and validators agree it is. The exposed parties are the bridges and lenders that accept a chain's minted assets at face value. They absorb the loss when issuance breaks, and Ethereum is where the extracted value ends up. The market tends to price a halt as a temporary outage. The larger cost is that bridges and centralized exchanges will lower deposit limits and lengthen confirmation times for young chains with recent virtual-machine or consensus upgrades. That lowers liquidity for exactly the long-tail networks already losing capital. The likelier outcome over the coming weeks is that Initia restarts with a patched MoveVM and a compensation plan, and that bridge operators add mint-rate or supply-change checks before releasing funds. The read is wrong if Initia recovers the funds and bridges keep their limits unchanged, which would mean the market treats such halts as routine.
Part of a tracked trend
Bridge and Mint Exploits Sustain Heavy DeFi Losses
Over 3-6 months, recurring bridge proof-validation and unauthorized-mint exploits keep monthly DeFi losses elevated, including drains of deprecated contracts.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Bitcoin Core Ends Year-Long Embargoes for Bugs That AI Can Rediscover
- Aztec Sets an End-2030 Deadline for Post-Quantum Migration and Commits to Formally Verifying Its Whole Stack
- Miden Pitches a Private-by-Default Finance Stack as Kraken Users Report Questions About Monero Withdrawals
- Franklin Templeton Puts $150 Million of Fund Shares on the XRP Ledger in One Wallet That Shares Signers With the Issuer
- Security Roundup: Slice Module on Base Loses $41,000 to Fake Payout Contracts as NEAR Intents Closes Its $3.8 Million Case
- Aave Lowers Its USDT Utilization Threshold to 92%, Raising Borrowing Costs Earlier to Protect Withdrawals
- HSBC Brings Its RedCoin Stablecoin to 3.3 Million PayMe Users as the OCC Finalizes Redemption Rules for US Issuers
Comments
0No comments yet.