# Initia's unauthorized mint, implanted Ledger devices and Abracadabra's emptied peg fund top the security docket Losses range from about $2.7 million at Initia to an estimated $102 million taken through tampered hardware wallets, and recoveries so far are partial or absent. - Published: 2026-11-09T05:43:40.268Z - Canonical: https://polylog.news/crypto/2026-11-09/initia-s-unauthorized-mint-implanted-ledger-devices-and-abra - Publisher: Polylog (Crypto desk) - Section: crypto - Sources: [Rekt News (Initia)](https://www.rekt.news/), [CryptoSlate](https://cryptoslate.com/the-catch-in-recovering-a-hacked-crypto-wallet-the-thief-may-still-have-a-key/), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/6bbb7b7893d3ccd2ef3d6018d991dc309ccdc281), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/2b75107ee2b85166bfeac240c608e3b1c15c04aa), [Cointelegraph](https://cointelegraph.com/news/initia-halts-blockchain-exploit-drained), [AMBCrypto](https://ambcrypto.com/initia-halts-l1-and-rollups-after-2-7-million-exploit-what-happened/), [The Block](https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442), [Crypto Briefing](https://cryptobriefing.com/abracadabra-mim-wind-down-proposal/) Recent entries on [rekt.news](https://www.rekt.news/) cover three failures, and none of them came from a standard smart-contract coding error. **Initia, about $2.7 million, own layer-1 and rollups.** On October 23, Initia halted its chain and rollups after an attacker [minted tokens without authorization](https://cointelegraph.com/news/initia-halts-blockchain-exploit-drained) and converted them into other assets. The root cause is a logic bug in the chain's own code. Initia blamed a flaw in the script caching of its MoveVM implementation, which runs on the Cosmos software development kit (SDK). [AMBCrypto reports](https://ambcrypto.com/initia-halts-l1-and-rollups-after-2-7-million-exploit-what-happened/) that the attacker created 2 million AUSD tokens with a single signed transaction, which let the attacker skip bridge verification entirely, and then bridged the proceeds to Ethereum. Initia says the native INIT supply was not affected. Agora, the issuer of AUSD, said its canonical token is fully backed and that it has no contracts on Initia. A patch is under audit. No post-mortem or recovery has been published. **Ledger devices from a reseller, an estimated $102 million.** This was a supply-chain hardware attack. Ledger's Donjon security team [confirmed an implant](https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442) in units sold by CryptoBilis, a Southeast Asian reseller. The implant reads the 24-word recovery phrase off the screen during setup and sends it out over a cellular connection. It does not affect the device's secure chip or operating system. Rekt.news puts the losses at about $102 million. Ledger calls the number of affected devices "limited" and has not confirmed a total. The European retailer MediaMarkt Saturn stopped selling Ledger devices on October 13 after a customer in Germany reported a tampered unit. Ledger has not confirmed that any units sold by MediaMarkt were affected. **Abracadabra, governance treasury.** Rekt.news reports that the SPELL peg fund was emptied, a further 8 billion SPELL tokens were minted, and treasury assets moved toward exchanges, while the accounting that would explain these moves is still missing. The protocol was already [winding down](https://cryptobriefing.com/abracadabra-mim-wind-down-proposal/) after about $21 million in bad debt, with an estimated payout of about four cents per MIM stablecoin. The sources reviewed carry no public accounting from Abracadabra. [CryptoSlate notes](https://cryptoslate.com/the-catch-in-recovering-a-hacked-crypto-wallet-the-thief-may-still-have-a-key/), using Keplr as its example, that restoring a hacked wallet from backup does not remove the thief's copy of the key. Funds have to move to a newly generated key. The DeFiHackLabs feed carried only documentation edits to its reproduction of a historical Opyn exploit ([1](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/6bbb7b7893d3ccd2ef3d6018d991dc309ccdc281), [2](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/2b75107ee2b85166bfeac240c608e3b1c15c04aa)) and logged no new incident. ## What this means All three losses happened outside the code that audits usually cover: a chain's virtual machine, a hardware distribution channel, and a treasury under governance control. The exposure falls on application-specific chains that run their own virtual machines, on buyers of hardware wallets through resellers, and on holders of a failing stablecoin whose recovery depends on insiders accounting for the assets. The closest precedent for Initia is the October 2022 BNB Chain bridge exploit. A forged proof minted about $570 million in BNB, and validators halted the chain within hours, which contained most of the damage. Initia took the same approach, which shows how much power a small validator set has to stop a chain. The desk's read is that Initia restarts within weeks once the audited patch lands, without recovering the bridged funds. Hardware-wallet makers will push buyers toward direct sales and device authenticity checks over the coming months. That depends on no new implant cases appearing at mainstream retailers. If Ledger confirms tampered MediaMarkt units, the problem becomes a retail-channel breach and the case for custodial products grows. For Abracadabra, MIM holders receive a share of ether only if the treasury movements are reconciled in public. ## What to watch - Initia's post-mortem and restart date. They will show whether the MoveVM caching flaw affects other chains that use the same virtual machine. - Whether Ledger confirms or rules out tampered units sold through MediaMarkt. Confirmation would move the problem from a single rogue reseller to mainstream European retail. - A public reconciliation of the Abracadabra treasury movements. Without one, the wind-down payout to MIM holders cannot be verified.