Most tokens you see on a second or third blockchain are not the original asset. They are bridged versions: claims that are supposed to be backed one-to-one by real tokens locked somewhere else. When that backing breaks, the damage can spread across chains within minutes.
That is exactly what happened on Friday, October 23, 2026, when Initia, a layer-1 blockchain built around a network of rollups, halted its main chain and rollups after a security incident. This guide uses that event to explain what an unbacked mint exploit is and how users can protect themselves.
How bridged tokens are supposed to work
A cross-chain bridge usually follows a lock-and-mint or burn-and-release model:
- You lock a token, such as USDC or ETH, in a contract on the source chain, for example Ethereum.
- The bridge sends a message to the destination chain, and an equal amount of a bridged version is minted there.
- When you want to go back, the bridged version is burned and the original tokens are released from the lockbox.
The whole system depends on one rule: bridged tokens should only be created when real tokens are locked on the other side. As long as that rule holds, every bridged token can be redeemed.
What an unbacked mint exploit is
An unbacked mint happens when an attacker finds a way to create bridged tokens without locking anything. Those tokens look identical to legitimate ones. If the attacker then sends them back through the bridge, the bridge treats them as real and releases genuine assets from the lockbox.
The result is that the people who locked real assets in the bridge are left holding claims that are no longer fully backed. The attacker walks away with real tokens on a major chain, where they can be swapped and moved quickly.
What happened at Initia
Based on Initia's statements and on-chain analysis reported by The Block, Cointelegraph and the security advisory site 0xCERT:
- Initia co-founder Ezaan Mangalji, known as Zon, described a previously unknown "Day 0" bug in Initia's MoveVM implementation on the Cosmos SDK that allowed unauthorized token minting. He said it did not apply to the native INIT token.
- According to D2 Finance, a single transaction at 14:59 UTC minted 2,000,000 units of a bridged AUSD token on Initia.
- Within about seven minutes, roughly 1.4 million AUSD and 105 ETH were released from bridge contracts on Ethereum, and about 1.08 million USDC was minted on Ethereum through Circle's cross-chain transfer protocol.
- Initia halted its L1 and rollups at 15:41:30 UTC. Zon said the attacker minted and bridged out about $2.7 million worth of AUSD, ETH and USDC before the pause.
- D2 Finance reported that the proceeds were swapped to ETH and consolidated in a wallet holding about 1,135.5 ETH, worth roughly $2.73 million at the time.
Agora, the issuer of AUSD, said its own contract is not deployed on Initia and that a separate third-party product using AUSD on Ethereum was affected. D2 Finance later said the loss sits with depositors of that third-party bridge adapter. At the time of writing, Initia had not confirmed the total loss, published a root cause or announced a restart time.
Interestingly, INIT fell about 14% right after the exploit was reported, then reversed and traded about 14% higher on the day, according to The Block. Market reactions to hacks are not always predictable, which is one more reason not to trade on headlines alone.
Why these exploits move so fast
Unbacked mint attacks combine two things that favour the attacker:
- Speed: bridge messages and swaps settle in minutes, while a chain halt requires coordination among validators.
- Liquidity on large chains: once real assets arrive on a chain like Ethereum, they can be swapped into ETH or other liquid tokens almost instantly.
In the Initia case, roughly 40 minutes passed between the malicious mint and the network halt, and most of the value had left within the first few minutes.
How to reduce your exposure as a user
You cannot audit every bridge yourself, but you can make choices that limit risk:
- Prefer native or issuer-backed versions of stablecoins where possible, and check which contract a token actually comes from.
- Do not keep large balances in bridged assets on smaller chains for longer than you need to.
- Spread exposure instead of routing everything through one bridge or one wrapped token.
- After any exploit report, pause deposits and withdrawals involving the affected chain until the team confirms a fix through official channels.
- Ignore unofficial links and "refund" or "claim" messages that appear after a hack. Initia itself warned users to stay cautious of unofficial claims during the incident.
- Watch for depegs: if a bridged token starts trading below its underlying asset on DEXs, it can be an early sign that its backing is in question.
When you swap between networks on any platform, including AviorSwap, which lists 17+ networks, double-check the network, the token contract and the receiving address before you confirm.
Key takeaways
- A bridged token is only as safe as the rule that it is minted when real assets are locked elsewhere.
- An unbacked mint lets an attacker create tokens from nothing and redeem them for real assets on another chain.
- At Initia, about $2.7 million was reportedly moved to Ethereum before the chain was halted, and the full impact was still under investigation at the time of writing.
- Limiting time and size in bridged assets, and pausing activity after exploit reports, are simple habits that reduce risk.
This article is for information only and is not financial or security advice. Always verify updates through a project's official channels.