Hacker mints tokens on Initia Chain, cashes out about $2.6 million

Somebody found the money printer on Initia Chain. Then they used it.

On October 23, 2026, an unauthorized actor carried out what blockchain security researcher Spreek described as an “infinimint” exploit on Initia, the modular layer one blockchain built around interwoven rollups. By the time the first reports surfaced, the attacker had reportedly converted around $2.6 million worth of freshly minted assets, and more was expected to move.

What happened on Initia

An infinimint exploit is what it sounds like. The attacker gained the ability to mint tokens with no cap, then swapped those tokens for assets that held real value. The damage comes when they get swapped into something real before markets catch on.

Spreek flagged the activity publicly, and the minting operations tied to the exploit were confirmed through a transaction visible on the official Initia explorer. The attacker had cashed out approximately $2.6 million by the time of reporting, with additional assets still in transit.

Initia had not issued an official response or detailed breakdown of the incident as of the initial reports.

A young chain with serious backing

Initia’s mainnet launched in 2025, along with its native token, INIT, which has a total supply of 1 billion. The project raised about $24 million from investors, a list that includes Binance Labs and Delphi Digital. It has also gone through multiple security audits.

This is also not Initia’s first operational stumble. The project previously ran into a significant configuration error involving INIT staking rewards. That one was not an exploit, and it was resolved in 2025 through governance actions.

Why modular design adds wrinkles

Initia’s pitch centers on interwoven rollups built on the Cosmos SDK, supporting both MoveVM and EVM environments. That architecture expands the surface area where something can go wrong. More moving parts means more places where token creation, bridging, or permissions might be misconfigured.

What this means for users and the INIT ecosystem

When an attacker mints tokens out of thin air and dumps them, they effectively drain value from whatever pools or counterparties accept those tokens. Liquidity providers on the receiving end of those swaps are often the ones left holding the bag.

There are a few concrete things worth watching from here:

The official post-mortem. Initia’s explanation of the vulnerability will determine how serious the flaw was. A bug in one app built on the chain is a very different story from a flaw in core minting logic.

The final tally. With assets still reportedly in transit, the approximately $2.6 million figure may not be the end of it.

Any chain-level intervention. Projects facing exploits sometimes pause modules or coordinate with exchanges and bridges to slow the flow of stolen funds.

Auditor accountability. If the flaw sat in code that was reviewed, expect pointed questions about scope and coverage. Multiple audits are a selling point right up until they are not.