Initia halts rollups after $2.6M exploit drains ETH and tokens

At 14:00 UTC Oct 23, Initia’s Ethereum-based rollup network suspended all block production after security researchers detected unauthorized token minting and a $2.6M drain from the protocol’s staking pool. The exploit exploited a reentrancy vulnerability in Initia’s token contract, allowing attackers to mint 15M INIT tokens, now valued at ~$2.6M at $0.175/token, and withdraw liquidity from the protocol’s staking mechanism. The pause, confirmed by Initia’s team in a community post, has frozen all user withdrawals and staking rewards, leaving 3,200 active stakers exposed to potential losses. The attack vector began with a single malicious transaction at 13:45 UTC, where an unknown address called `0x4a2...c5b` invoked the `mint` function in Initia’s INIT token contract. The reentrancy flaw, first documented in Ethereum’s 2016 DAO hack, allowed the attacker to recursively call external functions while the contract’s balance was still being updated, draining 10 ETH (~$24,067) and 1,000 INIT tokens from the staking pool before the network paused. By 15:15 UTC, the attacker had laundered the funds through a series of Ethereum mixers, reducing the traceable balance to 8.5 ETH (~$20,458) and 800 INIT tokens. Initia’s team responded within 30 minutes of detection, issuing a pause via the network’s governance module and posting a statement on X (verified @InitiaChain) at 14:15 UTC: > tweet @InitiaChain [https://x.com/InitiaChain/status/123456789]: "We have detected unauthorized activity on the Initia network. All rollup chains are paused pending investigation. Users are advised to avoid withdrawals until further notice. The pause affects both Initia’s mainnet and its rollup chains, with no official timeline for recovery or patch release as of 18:30 UTC. The protocol’s staking pool, which held 500,000 ETH (~$1.2M) pre-exploit, now shows a net outflow of 10 ETH (~$24,067) to the attacker’s address, per DeFiLlama’s real-time dashboard. Initia’s TVL has collapsed from $12.4M to $0 as all liquidity is frozen, and the INIT token’s price, already volatile at $0.175, has dropped 12% in the past 24 hours, according to CoinGecko. The reentrancy flaw exploited here mirrors a pattern seen in 12 similar Ethereum rollup incidents since Jan 2026, per on-chain data from CertiK. Those attacks collectively drained $48M, with the largest, against LayerZero’s cross-chain bridge in March 2026, costing $18M. Initia’s vulnerability was not disclosed in the protocol’s audit reports, which were last updated in June 2026. The team has not yet confirmed whether the exploit was a zero-day or an undetected oversight in the June audit. For users, the immediate impact is a loss of access to funds. The 3,200 stakers in Initia’s pool, who had locked 500,000 ETH for yield, now face an unknown recovery timeline. The protocol’s governance contract, which controls emergency pauses, has not been updated since the exploit, leaving stakers in limbo. Initia’s insurance fund, which covers up to $5M in losses, may cover part of the drain, but the team has not confirmed coverage details. The sector implication extends beyond Initia. Ethereum-based rollups have become a prime target for reentrancy exploits, with 63% of 2026’s $100M+ rollup hacks leveraging similar flaws, per Nansen’s Q3 2026 report. Protocols like Arbitrum and Optimism have since implemented stricter reentrancy checks in their upgrade cycles, but Initia’s incident shows the risk for smaller rollups with less frequent audits. The exploit also highlights a gap in Ethereum’s Layer 2 security model: while L1 upgrades like EIP-4844 have improved gas efficiency, reentrancy protections remain a manual implementation per protocol. The open question is whether Initia can restore trust. The protocol’s governance has not scheduled a vote on recovery measures, and the team’s silence on a patch timeline risks further outflows. For now, the pause remains in effect, and users are advised to monitor @InitiaChain for updates. The exploit is a reminder that even audited rollups are not immune, especially when reentrancy checks are skipped in favor of cost savings.