Two separate exploits have rattled decentralized finance in late October 2026, exposing governance capture and bridge-minting flaws that together drained about $7.4 million in assets. Chainalysis disclosed a $4.7 million stablecoin theft from the X100 protocol, while Initia halted its layer-1 network and rollups after an attacker exploited a Day-0 MoveVM bug to extract roughly $2.7 million in bridged tokens.
On X100, Chainalysis reported that attackers used contracts to capture protocol Senate seats, gaining a voting majority and manipulating treasury assets. The vulnerability let the Freezer treasury dump assets into an attacker-controlled pool. Around 560,000 X tokens remained unsold at attacker addresses at the time of the report, while the stolen stablecoin value was swapped into ETH and distributed across four wallets, each holding approximately 400 ETH.
Initia stopped producing blocks at 15:41:30 UTC on October 23, about forty-two minutes after an attacker minted 2,000,000 AUSD out of nothing. Pseudonymous researcher Spreek flagged the on-chain activity fourteen minutes before the halt. Co-founder Ezaan Mangalji said the preliminary diagnosis pointed to a Day-0 bug related to Initia’s MoveVM on CosmosSDK that allowed extra token minting on Initia L1 but did not apply to native INIT tokens. The attacker minted and bridged out about $2.7 million worth of AUSD, ETH, and USDC before the chain was paused.
Analytics firm D2 Finance traced the exploit to a single signed transaction at 14:59:26 UTC that minted 2,000,000 AUSD on Initia. Within 153 seconds, a LayerZero message released 1.4 million real AUSD from the Ethereum-side adapter. A further 105 ETH followed at 15:06:47 UTC, and 1.08 million USDC arrived on Ethereum through Circle’s CCTP. D2 Finance estimated that $2.65 million was extracted within 7 minutes and 21 seconds, a rate of roughly $6,000 per second. The bridge issue reflected a failure in verifying whether burned tokens were ever backed.
Agora, the issuer of the AUSD stablecoin, said it has no smart contracts deployed on Initia and that it would freeze funds related to hacker addresses on chains where real AUSD contracts exist. Initia’s native INIT token fell to about $0.115 on October 23 before rebounding above $0.15, and the chain remained halted at block height 23365925 more than six hours after the incident with no restart date announced.
The incidents reinforce rising concerns about decentralized governance and cross-chain bridge architecture. With Cosmos-based networks having seen similar mint-and-bridge failures before, the events may accelerate calls for stricter security audits and real-time threat monitoring.
