# Initia halts its chain and rollups after a reported uncollateralized stablecoin mint drains about $2.6 million

A researcher said 2 million AUSD were minted without backing and bridged out to Ethereum with ETH and USDC. In the same week, Base's Slice protocol and the WAX bridge lost smaller sums, and Keystone confirmed that hackers took customers' names and home addresses.

- Published: 2026-10-25T05:49:12.746Z
- Canonical: https://polylog.news/crypto/2026-10-25/initia-halts-its-chain-and-rollups-after-a-reported-uncollat
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Polylog editors](https://polylog.news), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/eb2325b68b83f3ce6a6e743352f82097be1c6875), [Rekt News](https://www.rekt.news/), [crypto.news](https://crypto.news/initia-halts-blockchain-rollups-2-6m-exploit/), [Cointelegraph](https://cointelegraph.com/news/initia-halts-blockchain-exploit-drained), [Crypto Times (Slice)](https://www.cryptotimes.io/2026/10/21/slice-protocol-exploit-on-base-drains-41k-as-fundsmodule-trusts-fake-payout-contracts/), [Crypto Times (WAX)](https://www.cryptotimes.io/2026/10/22/wax-multi-chain-bridge-exploited-for-roughly-75000/), [Crypto Times (NEAR Intents)](https://www.cryptotimes.io/2026/10/17/near-intents-traces-3-8m-exploit-to-smart-contract-deposit-bug/)

Initia, a layer-1 network that hosts its own family of rollups, [halted its chain and rollups](https://crypto.news/initia-halts-blockchain-rollups-2-6m-exploit/) after an exploit that drained more than $2.6 million. Spreek, the security researcher who first flagged the incident, said [2 million AUSD were minted without collateral](https://cointelegraph.com/news/initia-halts-blockchain-exploit-drained). The attacker then moved 1.4 million AUSD, 105 ETH and 1.08 million USDC to Ethereum. D2 Finance attributed the exploit to a flaw in a function written in Move, Initia's smart-contract language. Initia has not confirmed the cause or the size of the loss. This is an unauthorized-mint attack. Whether the root cause is a logic bug or a permissions failure is still unconfirmed. Circle can freeze USDC held at a given address, but no report says it has done so here.

The halt had two effects. It limited further damage, and it also showed that the team can stop the base chain and every rollup at the same moment. Users of these rollups should treat that as a central point of control.

Smaller incidents in the same week show the same accounting flaw. On Oct. 20, Slice's FundsModule contract on Base [lost about $41,000](https://www.cryptotimes.io/2026/10/21/slice-protocol-exploit-on-base-drains-41k-as-fundsmodule-trusts-fake-payout-contracts/) (8.72 ETH and 19,820 USDC). A public function accepted a list of payout sources supplied by the caller and never checked it against an approved set. It then credited the returned amounts without checking that the contract's balance had grown, and paid the credit out of pooled reserves. The attacker deployed two contracts that reported nonzero amounts while sending nothing. Researchers added a [proof-of-concept reproduction to DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/eb2325b68b83f3ce6a6e743352f82097be1c6875). The WAX multi-chain bridge [lost roughly $75,000](https://www.cryptotimes.io/2026/10/22/wax-multi-chain-bridge-exploited-for-roughly-75000/) on Oct. 22 when an attacker withdrew tokens, and the report gives no detailed root cause.

[Rekt News](https://www.rekt.news/) published its account of the NEAR Intents loss. Between Sept. 29 and Oct. 1, an attacker used 23 failed deposit transactions to create [about $3.8 million in balances not backed by tokens](https://www.cryptotimes.io/2026/10/17/near-intents-traces-3-8m-exploit-to-smart-contract-deposit-bug/), because the contract kept recording deposits even when the tokens were returned. NEAR Intents stopped deposits and withdrawals on 11 networks and recovered the funds within about 36 hours.

Keystone, a hardware-wallet maker, [confirmed an intrusion on its official website](https://t.me/GokuCryptoNews/21082) that it detected on Oct. 20. After reviewing access to its Shopify store, the company found that a third party had obtained customers' names and home addresses. No keys were exposed, but a list of crypto buyers with street addresses can be used for phishing and physical targeting.

## What this means

Slice and NEAR Intents failed the same way: each contract credited a balance before confirming that assets had arrived. Initia's mint may turn out to be the same flaw at a larger scale. The parties exposed to Initia are AUSD holders, who face a depeg if 2 million unbacked units remain in circulation, users of Initia's rollups, and exchanges that list its token. The closest precedent is BNB Chain in October 2022. An attacker forged proofs on its bridge to mint 2 million BNB, validators halted the network within hours, and most of the minted funds never left the chain. The desk's read is that within weeks Initia will restart with a patch and some combination of supply adjustment and reimbursement for AUSD. How much it recovers depends on whether the USDC sent to Ethereum is frozen and whether the attacker negotiates. The read would be wrong if Initia's post-mortem shows a compromised key or validator set rather than a contract bug. That finding would move the incident from code risk to infrastructure risk and raise harder questions about how the network is controlled.

## What to watch

- Initia's post-mortem and whether it names a contract flaw or a compromised privileged key, because that determines whether other Move-based chains need to audit similar functions.
- Whether Circle freezes the roughly 1.08 million USDC the attacker moved to Ethereum, since that decides how much of the loss can be recovered.
- Whether AUSD trades below its dollar target once the network restarts, because that shows if the market treats the unbacked mint as contained.