On October 23, Initia — a Cosmos SDK layer-1 that runs a constellation of rollups it calls Minitias — stopped producing blocks at 15:41:30 UTC. The trigger was not congestion or a routine bug. An attacker had minted two million AUSD tokens from nothing and moved roughly $2.7 million in real assets off the chain before anyone could pull the emergency brake.
The chain’s first public notice called the event “a security incident” and said nothing about the mechanics. Those details arrived in fragments over the following day, mostly through social posts rather than any formal write-up — and as of this report, Initia had still not published a post-mortem or confirmed a final loss figure.
What the fragments describe is a Day-0 bug in Initia’s implementation of MoveVM on the Cosmos SDK. Co-founder Ezaan Mangalji framed it as a minting flaw that let the attacker create token balances without authorization, while stressing that native INIT tokens sat outside the exploit’s reach. That distinction separates a contained incident from a supply shock. An attacker who prints the native token dilutes every holder at once; an attacker who prints a bridged representation of other assets — AUSD, ETH, and USDC, as the co-founder listed — is constrained by the real collateral behind those representations.
The transaction trail, decoded by analytics firm D2 Finance, shows that constraint in action. A single signed transaction at 14:59:26 UTC minted two million AUSD on the Initia side. Within minutes, a LayerZero message released 1.4 million real AUSD from the Ethereum-side adapter, 105 ETH followed, and 1.08 million USDC arrived on Ethereum through Circle’s CCTP. By D2 Finance’s timestamps, roughly $2.65 million was back on Ethereum about seven and a half minutes after the mint.
The mechanism is what any post-mortem will have to explain. Initia’s bridged assets sit behind OFT adapters — lockbox contracts that release real tokens when the matching Initia-side balance is burned. An adapter can confirm that tokens were burned; it cannot, in D2 Finance’s framing, confirm the burned tokens were ever backed. The attacker minted an unbacked claim, burned it, and collected genuine collateral.
Agora, the issuer of the AUSD stablecoin, drew a distinction of its own. The company said it has no smart contracts on Initia and that its security team would freeze funds tied to hacker addresses on chains where AUSD’s contracts actually live. In other words, the two million “AUSD” minted on Initia was a bridged representation, never Agora’s own token. The reassurance has limits: if the bridged representation was backed by genuine AUSD held in the adapter’s lockbox, that genuine AUSD has already moved.
A full chain halt is the bluntest tool a network has, and Initia used it on purpose. Stopping consensus blocks further minting and bridging, but it also freezes every legitimate user and application. The market read the incident as bounded rather than catastrophic: INIT fell to about $0.115 before rebounding above $0.15, a response consistent with a non-dilutive exploit rather than a supply shock.
What stays open is operational. Initia has not set a restart date or identified a specific technical cause. The next meaningful signal is the promised post-mortem. Until it arrives, the confirmed facts remain narrower than the circulating numbers: a chain was halted, a preliminary diagnosis pointed to a Day-0 MoveVM bug, and roughly $2.7 million in bridged assets left for Ethereum before the network could be paused.
Adapted from Initia Halts L1 and Rollups After a Day-0 Mint Exploit Drains $2.7 Million.