Initia halts its chain and rollups after a reported uncollateralized stablecoin mint drains about $2.6 million

Initia, a layer-1 network that hosts its own family of rollups, halted its chain and rollups after an exploit that drained more than $2.6 million. Spreek, the security researcher who first flagged the incident, said 2 million AUSD were minted without collateral. The attacker then moved 1.4 million AUSD, 105 ETH and 1.08 million USDC to Ethereum. D2 Finance attributed the exploit to a flaw in a function written in Move, Initia's smart-contract language. Initia has not confirmed the cause or the size of the loss. This is an unauthorized-mint attack. Whether the root cause is a logic bug or a permissions failure is still unconfirmed. Circle can freeze USDC held at a given address, but no report says it has done so here.

The halt had two effects. It limited further damage, and it also showed that the team can stop the base chain and every rollup at the same moment. Users of these rollups should treat that as a central point of control.

Smaller incidents in the same week show the same accounting flaw. On Oct. 20, Slice's FundsModule contract on Base lost about $41,000 (8.72 ETH and 19,820 USDC). A public function accepted a list of payout sources supplied by the caller and never checked it against an approved set. It then credited the returned amounts without checking that the contract's balance had grown, and paid the credit out of pooled reserves. The attacker deployed two contracts that reported nonzero amounts while sending nothing. Researchers added a proof-of-concept reproduction to DeFiHackLabs. The WAX multi-chain bridge lost roughly $75,000 on Oct. 22 when an attacker withdrew tokens, and the report gives no detailed root cause.

Rekt News published its account of the NEAR Intents loss. Between Sept. 29 and Oct. 1, an attacker used 23 failed deposit transactions to create about $3.8 million in balances not backed by tokens, because the contract kept recording deposits even when the tokens were returned. NEAR Intents stopped deposits and withdrawals on 11 networks and recovered the funds within about 36 hours.

Keystone, a hardware-wallet maker, confirmed an intrusion on its official website that it detected on Oct. 20. After reviewing access to its Shopify store, the company found that a third party had obtained customers' names and home addresses. No keys were exposed, but a list of crypto buyers with street addresses can be used for phishing and physical targeting.