Initia, a Layer 1 blockchain, halted its L1 and all rollups late on Oct. 23 Taipei time after an attacker exploited a flaw to mint tokens and convert them into real assets on Ethereum through cross-chain routes. In a statement on X, Initia said the network stopped at 15:41:30 UTC, or 23:41 Taipei time, and that the team was working with security teams, validators, and exchanges to determine the scope of the incident.
Co-founder says MoveVM zero-day flaw was used
Initia co-founder zon, whose X account is @ItsAlwaysZonny, said that based on what the team knew so far, the incident stemmed from a zero-day vulnerability in MoveVM running on Cosmos SDK. He said the flaw allowed the attacker to inflate token balances on Initia L1, while the native token INIT was not affected.
According to zon, the attacker minted and moved out about $2.7 million worth of AUSD, ETH, and USDC before the chain was halted. Initia has not released a full loss assessment or a recovery schedule.
Early warning and transaction breakdown
The first public warning came from on-chain analyst Spreek. At 15:27 UTC, Spreek wrote that Initia had been hacked, that large amounts of tokens were being minted without limit, and that the attacker had already cashed out $2.6 million. Spreek also said the attacker minted bridgeable assets and bridged them out personally, effectively draining the bridge contracts and leaving tokens such as AUSD on Initia without full backing.
DeFi derivatives strategy platform D2 Finance later published a breakdown of the transactions. It said that at 14:59:26 UTC, one transaction minted 2 million AUSD out of thin air. Another 153 seconds later, a valid LayerZero cross-chain message released 1.4 million real AUSD from the Ethereum-side adapter contract. From the moment of minting, about $2.65 million had returned to Ethereum within 7 minutes and 21 seconds.
Three exit routes identified
D2 Finance said the attacker used three main routes to move funds out:
- 1.4 million AUSD, equal to 71% of the adapter contract balance;
- 105 ETH, equal to 96% of the native ETH adapter contract balance;
- 1.08 million USDC newly issued through Circle’s Cross-Chain Transfer Protocol, or CCTP.
Those stablecoins were swapped into ETH through 1inch and 0x within 3 minutes of arrival. In total, 1,135.52 ETH, worth about $2.73 million, was sent to a newly created wallet. As of midday on Oct. 24 Taipei time, the wallet still held the ETH, according to the report.
Why the Ethereum side paid out
D2 Finance said the minting step was completed when the attacker used a private key to call a Move function directly. No cross-chain message was involved in that part of the process. The function parameters could specify the recipient, token, and amount, which meant the same wallet could mint AUSD, USDC, and ETH separately.
The firm said LayerZero’s verification network confirmed that a burn event had occurred on Initia, but the Ethereum-side adapter contract could not determine whether the burned tokens had ever been properly backed in the first place. If Initia had a minting flaw, the locked-asset contracts on Ethereum would still pay out at face value.
Preparation traced back 6.5 hours
D2 Finance also traced the attacker’s setup. It said the wallet received 0.1 ETH from Tornado Cash 6.5 hours before the minting event, then sent small test transactions through an Axelar contract. At 14:37 UTC, the wallet deposited 0.006 ETH into the same ETH adapter contract that it drained 29 minutes later.
D2 Finance said the method matched the Sept. 6 Liquid Network incident, when an Elements flaw produced 4,000 L-BTC and a valid redemption flow was then used to withdraw 3,996 real BTC.
Agora freezes addresses, Upbit suspends INIT transfers
AUSD issuer Agora said it had not deployed any smart contracts on Initia. It added that its security team would freeze AUSD held by the hacker on chains where the AUSD contract is deployed. South Korean exchange Upbit also announced a suspension of INIT deposits and withdrawals.
Because Initia L1 handles cross-chain functions and liquidity for its rollups, the halt also froze user transfers and trading on InitiaDEX.
TVL, volume, and INIT price
D2 Finance data showed that InitiaDEX had about $3.5 million in total value locked and $334,000 in 24-hour trading volume. The amount moved out by the attacker’s single wallet through the bridge in 7 minutes and 21 seconds was eight times the latter figure.
According to CoinGecko, INIT was trading at $0.133 as of midday on Oct. 24 Taipei time, roughly flat over the previous 24 hours.