Initia halts its blockchain after a mint bug bridges out $2.7 million

Initia stopped its blockchain and all connected rollups on October 23 after an attacker exploited a bug to mint tokens and move about $2.7 million to Ethereum. A day later the network was still offline, with no restart date set.

The halt took effect at 3:41:30 p.m. UTC, according to a notice from Initia's official account, which cited a security incident and said the full scope was still being worked out. Co-founder Ezaan Mangalji put the early loss near $2.7 million in AUSD, ETH and USDC. He called the figure preliminary. The team has not confirmed a final total.

What the attacker did

The exploit hit a part of DeFi most users never see: the plumbing between chains. Mangalji said the flaw was a "Day 0 bug related to Initia's MoveVM on CosmosSDK" that let the attacker mint extra tokens on the network's base layer. He said it did not touch native INIT, Initia's own token. That claim has not been independently confirmed.

Trading firm D2 Finance traced the money. By its account, the attacker minted about 2 million AUSD on Initia with nothing behind it, then sent the tokens across a bridge to Ethereum. There the attacker pulled 1.4 million AUSD, 105 ether and 1.08 million USDC. D2 said that was 71 percent of the AUSD held in one bridge adapter and 96 percent of the ether in another. The proceeds landed in a single new wallet holding about 1,135.5 ETH, which D2 valued near $2.7 million on October 23.

Speed mattered. The pseudonymous researcher Spreek flagged the attack at 11:27 a.m. Eastern time. By then the bridged funds had already reached Ethereum, D2 said, inside about seven minutes of the first mint. Spreek estimated roughly $2.6 million was cashed out.

Why a token called fully backed still bled

Here the accounts diverge. Agora, the company behind AUSD, said flatly that AUSD "does not exist on Initia" and that the stablecoin is fully backed. Mangalji had said the attacker minted AUSD on the chain. Both can be true. The token on Initia was a bridged stand-in for the real AUSD, and the real coins sat in adapter contracts on Ethereum.

D2 pointed to the weak link. "An OFT adapter cannot check whether burned tokens were ever backed," the firm wrote. In plain terms, the Ethereum side handed over real coins when the bridged tokens came back, without knowing they had been created from nothing on Initia. The bridge trusted the chain. The chain had a bug. Bridges keep failing this way. Days earlier, Cysic paused its own bridge after an attacker minted 10 million of its tokens.

Exchange and market response

Upbit, a South Korean exchange, suspended INIT deposits and withdrawals after the halt. INIT fell on the news, then recovered. Bitcoin.com reported it traded about 12.5 percent higher over the 24 hours around the incident, and about 65.8 percent higher over the prior 30 days, since September 23.

Agora said it froze the attacker's Ethereum address about 90 minutes after the funds moved, and that it would freeze hacker-linked funds on any chain where its contracts run. It added that AUSD and Agora were unaffected. Neither Initia nor Agora has said how much of the money, if any, can be recovered.

What to watch

A restart date is the first thing to watch. A day after the halt, Initia had set none, and its L1 and rollups stayed frozen at block 23365925. Anything built on those rollups is stuck with them.

Then comes the post-mortem. Mangalji's account is preliminary, and the team has said it wants to establish the full scope before saying more. Until a final report lands, the loss figure, the cause, and the claim that INIT is safe all rest on early numbers. Watch, too, whether the funds Agora froze on Ethereum are clawed back.