Initia incident: unbacked token creation exposed bridge reserves

A shutdown announced after a security incident

Initia announced the halt of its main blockchain and rollups on October 23, 2026 following a security incident. The announcement is reported by The Block and included in the 0xCERT advisory. This article examines the facts and analyses published about that incident without establishing the network's status in real time.

Co-founder Ezaan Mangalji, known as Zon, described a previously unknown flaw in the MoveVM implementation on Cosmos SDK. According to his preliminary account reported by The Block, the issue allowed unauthorized token creation but did not affect the creation of native INIT tokens.

Tokens created and funds withdrawn are different amounts

In its original investigation, Bitquery estimates that $2.73 million in assets actually moved out to Ethereum. This estimate is attributed to its analysis of on-chain movements. It should not be confused with the face value of all tokens created without backing, or with a final loss assessment confirmed by Initia.

The difference matters when measuring an incident. An attacker may create a large quantity of digital representations without being able to sell all of them at the expected price. The loss actually realized depends in particular on available liquidity and reserves that can be withdrawn. Simply adding up the tokens created can therefore provide a misleading picture of losses.

The role of bridges in moving assets

A bridge can lock an asset on one network and allow a representation to be used on another. When that representation returns, the system releases the corresponding assets according to its rules. The reliability of this correspondence is part of the arrangement's security.

Bitquery's analysis describes representations created on Initia and then used to obtain assets on Ethereum. This description does not mean that a stablecoin issuer itself created unbacked units on its own infrastructure. The network, the representation contract and the reserve accessed must be identified separately.

Do not invent a phishing explanation

The material reviewed does not support presenting the incident as a simple malicious permission signed by a user. A flaw in execution or token creation does not automatically call for the same response as theft of a recovery phrase. Revoking permissions is not a demonstrated fix for the flaw described.

People affected need to distinguish official communications, preliminary technical analyses and messages claiming to offer assistance. An unverified refund link does not become reliable because an incident is real. The next decisive information will be a consolidated technical account, a confirmed assessment of losses and the project's stated conditions for restoring service.