Initia chain exploited through infinite token minting, $2.6M withdrawn so far
Security & Exploits ·
An attacker is minting unlimited tokens on the Initia chain and has already cashed out $2.6 million, with additional funds reportedly still in motion.
The exploit centers on an infinite mint vulnerability, a flaw that lets an attacker generate tokens without the normal supply constraints built into the chain's logic. Once minted, those tokens can be moved and converted, allowing the attacker to extract real value from the network faster than defenders can respond. The attack appears to still be unfolding, meaning the $2.6 million figure may not represent the final total.
A sample transaction tied to the fraudulent minting has been identified, along with an address linked to the attacker, details first surfaced in a post on X describing the chain as "hacked" with "a bunch of tokens infiniminted." The same post notes the attacker has cashed out $2.6 million thus far, with more funds potentially still in transit toward exchanges or other off-ramps.
Multiple independent accounts have converged on the same core details: the exploit involves infinite minting on Initia, and the figure cashed out stands at $2.6 million. The consistency of that dollar amount across separate reports suggests the number reflects on-chain activity that observers were able to track in near real time, though none of the available material specifies which token or tokens were minted, nor the full scope of affected contracts.
It remains unclear whether Initia has paused the chain, frozen the attacker's address, or issued any formal statement addressing the exploit. Also unresolved is the total amount at risk beyond what has already been cashed out, since the attack was still described as ongoing when details first emerged. Further confirmation from the protocol itself, along with any response from exchanges handling the attacker's outflows, will determine how much of the stolen value can be recovered or frozen before it moves further downstream.