SECURITY ALERT

The chain is stopped.

The money it let out is already on Ethereum.

Initia, a layer-1 blockchain built around a network of rollups, halted its main chain and rollups at 15:41:30 UTC on Friday after what it called a security incident, roughly 40 minutes after an attacker began pulling an estimated $2.7 million in AUSD, ETH and USDC out to Ethereum.

Initia says it is investigating with security teams, validators and exchanges. It has not published a cause, a loss figure or a restart time.

The $2.7 million estimate comes from Zon, an engineer whose post Initia reposted. Zon described a “Day 0 bug” in Initia’s MoveVM, the engine that runs its smart contracts, on the Cosmos SDK.

According to Zon, the bug let the attacker mint extra tokens on Initia’s main chain. It “does not apply to native INIT tokens,” Zon wrote.

So how did tokens minted on Initia turn into assets on Ethereum?

The timeline

All times UTC, Friday 23 Oct, from on-chain analysis by D2 Finance unless stated.

  • 14:59:26: one transaction on Initia mints 2,000,000 tokens of a bridged AUSD, the Initia-side copy of the dollar token used by a LayerZero bridge contract on Ethereum.
  • 15:01:59: that bridge contract on Ethereum releases 1.4 million real AUSD.
  • 15:06:47: 105 ETH leaves the same way.
  • 15:27: security researcher Spreek flags the outflow publicly, at about $2.6 million so far.
  • 15:41:30: Initia halts the chain, by its own timestamp.
  • 16:00: Initia posts the halt notice.

D2 puts about $2.65 million back on Ethereum within seven minutes and 21 seconds of the mint. Cointelegraph reported, citing D2, that about 1.08 million USDC also left and that the proceeds were gathered in an Ethereum wallet holding about 1,135.5 ETH, roughly $2.73 million.

Who carries the loss?

What is confirmed, and what is not

Confirmed by Initia: the halt, the time, and that it is investigating.

Not confirmed by Initia: the bug, the amount, or who holds the losses. The $2.7 million figure is from Zon and D2, not from Initia.

AUSD itself was not minted. Agora, which issues AUSD, said its contract “is not deployed on Initia” and that “a separate, third-party product not operated by Agora that uses AUSD on Ethereum was impacted.” Later it said AUSD “is fully backed.”

D2 corrected its first post to match. The loss “sits with the adapter’s depositors,” it wrote, meaning people who had locked AUSD in the bridge contract on Ethereum.

That contract is:

AUSD OFT adapter 0x38b8B7ca28E672018a299B20565aCa8cF200C844

By our reading of on-chain data at about 19:50 UTC, it still held about 576,141 AUSD. D2 says it is controlled by a multisig wallet, but who operates it has not been publicly stated.

Initia’s INIT token briefly fell to about $0.115 and later recovered above $0.15, Cointelegraph reported, citing CoinGecko.

How a dollar token keeps its value depends on reserves at the issuer, not on bridge contracts; how a dollar stablecoin is backed explains the difference.

Will depositors in the adapter be made whole?

What to do

  • If you held AUSD on Initia, or locked AUSD in the bridge, wait for Initia’s and the bridge operator’s own notices. Neither has published a recovery plan.
  • Do not use links offering refunds or claims. Incidents like this draw phishing, as happened after Swell’s pause of swETH and rswETH earlier on Friday.
  • If you trade INIT, check whether your exchange has paused deposits and withdrawals while the chain is down.

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.