Bottom line up front: Initia halted its Layer 1 chain and all of its rollups on Friday after a mint exploit let an attacker create unbacked tokens and bridge the proceeds off-network. Co-founder Zon put the extracted total at about $2.7 million in AUSD, USDC and ETH; on-chain analyst Spreek’s independent tally came in near $2.6 million. As of Saturday, Initia had published neither a post-mortem nor a restart date, with the chain frozen at block 23,365,925.
How the Initia Mint Exploit Worked
According to researcher D2 Finance, the attacker’s transaction at 14:59:26 UTC on Oct 23 created roughly 2,000,000 AUSD on Initia L1 without sufficient backing. The unbacked tokens were burned and moved across LayerZero to Ethereum; about 153 seconds later, a LayerZero message triggered the release of roughly 1.4 million AUSD from the protocol’s adapter on Ethereum. The attacker also obtained about 1.08 million USDC, swapped the stablecoins for ETH through 1inch and 0x, and consolidated 1,135.52 ETH – roughly $2.7 million at current prices – in a newly created wallet.
Initia co-founder Ezaan Mangalji attributed the breach to a "Day 0 bug" in Initia’s MoveVM implementation on Cosmos SDK: a flaw in a Move function that allowed unbounded minting on the L1. Native INIT tokens, he said, were not affected.
Is AUSD Still Backed?
Stablecoin issuer Agora pushed back on parts of the framing, stating that the tokens minted on Initia were a bridged representation and that AUSD itself remains fully backed. The nuance: the assets that backed the bridged representation left Initia’s adapters when the attacker redeemed through the bridge for real value, leaving holders of bridged tokens on the L1 staring at a shortfall.
What Happens Next
Initia said it is working with security teams, validators and exchanges to establish the full scope, and that it will post verified updates only through official channels. A restart is not a simple server reboot: observers note it requires the bug fix and a published post-mortem with error analysis before validators can reasonably return. No restart date had been announced as of Oct 24.
The market reaction was jarring but brief – INIT fell about 14% immediately after the exploit reports, then reversed to trade up roughly 14% on the day. The official loss figure remains unconfirmed until Initia’s own accounting lands. The incident also lands in a busy security season for crypto infrastructure, following cases like the Ledger hardware implant tied to the CryptoBilis losses.
Reporting based on The Block, Unchained and The Defiant, with on-chain figures from Spreek and D2 Finance. Initia has not officially confirmed the loss total.
