An unauthorized actor carried out an "infinimint" exploit on Initia, a modular layer one blockchain, on October 23, 2026. According to blockchain security researcher Spreek, the attacker gained the ability to mint tokens without any cap, then swapped those tokens for assets with established value. By the time initial reports emerged, approximately $2.6 million worth of freshly minted assets had been converted, with additional funds reportedly still in transit.
The minting operations were confirmed through transactions visible on Initia's official explorer. Initia had not issued an official response or detailed incident breakdown at the time of initial reporting.
About Initia's Network
Initia launched its mainnet in 2025 and raised approximately $24 million from investors including Binance Labs and Delphi Digital. The project's native token, INIT, has a total supply of 1 billion tokens and has undergone multiple security audits. The network had previously experienced a significant configuration error involving INIT staking rewards in 2025, which was resolved through governance actions.
Technical Architecture Considerations
Initia's architecture centers on interwoven rollups built on the Cosmos SDK, supporting both MoveVM and EVM environments. This modular design expands the potential surface area for misconfigurations in token creation, bridging, or permissions.
Implications for the Ecosystem
When attackers mint tokens and dump them into liquidity pools, value flows out of the ecosystem. Liquidity providers accepting the unauthorized tokens often absorb significant losses.
Key factors to monitor going forward include Initia's official explanation of the vulnerability, the final accounting of stolen funds, any chain-level interventions to halt fund movement, and questions regarding the scope and coverage of security audits that preceded the exploit.
