Initia Pauses L1 and Rollups After Token Minting Exploit Drains $2.7 Million

Initia’s halt follows a bridge exploit

Initia’s incident exposed a weakness at the boundary between its chain and the bridges holding assets for its rollups: an attacker minted tokens without backing, then used them to claim real assets on Ethereum. Initia’s layer 1 and rollups have been offline since 11:41 a.m. ET Friday, and the team hadn’t given a restart time as of 5:52 p.m. ET. The pause limits activity on the network while the team investigates, but it also leaves users waiting for information about when transactions can resume.

The project said it was working with security teams, validators and exchanges to determine the incident’s full impact. Co-founder Zon attributed the exploit, based on preliminary findings, to a “Day 0 bug related to Initia’s MoveVM on CosmosSDK.” He said the flaw allowed additional tokens to be minted on Initia L1, but didn’t affect native INIT tokens. Before the chain was paused, the attacker minted and bridged out about $2.7 million in AUSD, ETH and USDC. That distinction matters: the reported issue concerns how assets were created and moved through connected systems, while the team’s statement separates those tokens from INIT itself.

Researcher Spreek raised the alarm at 11:27 a.m. ET, 14 minutes before the halt, and estimated that $2.6 million had been cashed out. The sequence leaves a narrow interval between the public warning and the network pause. But an early estimate and a later transaction analysis don’t, by themselves, establish the final amount lost or recovered; Initia hasn’t published a post-mortem.

Unbacked tokens triggered real payouts

D2 Finance’s transaction analysis traces the sequence to a 10:59 a.m. ET transaction that minted 2 million AUSD on Initia. The attacker burned those tokens and sent them to Ethereum through LayerZero. There, OFT adapters—contracts holding the underlying assets for bridged tokens—released real funds. The result was a mismatch between the token representation sent from Initia and the assets paid out on Ethereum.

The key gap, D2 said, was that “an OFT adapter cannot check whether burned tokens were ever backed.” In this case, the minted AUSD representation could be burned and bridged even though no matching assets supported it on Initia. A bridge relies on rules that connect activity on one chain to assets held on another; if those rules accept a token burn without confirming its backing, the adapter can release funds against a claim that shouldn’t have been honored.

D2 estimates the attacker withdrew 1.4 million AUSD, or 71% of the AUSD adapter’s holdings, leaving roughly 576,000. The attacker also took 105 ETH, about 96% of the native-ETH adapter’s balance. A further 1.08 million USDC came through new mints using Circle’s CCTP. D2’s timeline puts about $2.65 million on Ethereum within seven minutes and 21 seconds of the initial mint. Those figures describe different parts of the flow, and shouldn’t be treated as interchangeable estimates of net losses: the available account doesn’t establish what was recovered or what assets remained accessible after the incident.

Here’s the thing: a bridge can be the point where a flaw on one chain becomes a payout from another. The incident’s mechanics, as described by D2, make that boundary central to understanding the reported losses. The speed also helps explain why pausing the network became a priority once the exploit was identified. Still, the pause doesn’t answer whether every affected contract or connected service has been assessed.

Agora distinguishes AUSD from its bridged version

Agora, AUSD’s issuer, said at 12:57 p.m. ET that it had no smart contracts deployed on Initia. At 2:26 p.m. ET, it clarified that “AUSD does not exist on Initia” and that the token is fully backed. Those statements point to the exploit involving a bridged representation of AUSD, with the real tokens held in an Ethereum lockbox adapter, rather than Agora’s issued asset being minted directly on Initia. The distinction is more than terminology: an issuer’s asset and a token that represents it across a bridge can depend on different contracts and controls.

Onchain records show that 1.4 million AUSD remained in the attacker’s Ethereum address for about 84 seconds before being traded through the 1inch aggregator at 11:03 a.m. ET. Agora froze the address at 12:31 p.m., around 89 minutes after the trade and before its first public statement; the wallet then held no AUSD. That timeline documents when the trade and freeze occurred, but it doesn’t establish what happened to the proceeds after the swap. The details of any recovery also remain unclear in the information Initia has released.

At 11:41 a.m. ET, the minute Initia halted its network, the same address sent 1,135.5 ETH to a newly used wallet. D2 valued that transfer at about $2.7 million. The near-simultaneous transfer and halt make the timing significant, though the available account doesn’t establish a direct link between the transfer and the decision to stop the network.

What the incident leaves unresolved

Initia hasn’t confirmed Zon’s loss estimate or released a post-mortem. Its team said verified updates would come through official channels; until then, the extent of the incident and the network’s restart timing remain open questions. Users and developers need both kinds of information: a clearer accounting of affected assets, and a practical indication of when the chain and rollups can operate again.

This is more significant than it looks. The reported failure involved an interaction among token minting on Initia, cross-chain messaging, and adapters holding assets on Ethereum. If you’re working in this space, the central issue is whether each step checks the assumptions made by the step before it. D2’s account suggests that burning a bridged token wasn’t enough to prove that it had been backed in the first place.

And yet, the details available so far support only a preliminary account. The team has tied the issue to a MoveVM bug, while D2 has described the transaction path and Agora has clarified the status of its AUSD. Those pieces help explain how real assets could leave an adapter, but a complete assessment depends on Initia’s own findings. For now, the open questions are concrete: what was affected, what was recovered, and what conditions must be met before service resumes.

The pause has stopped normal network activity, but it hasn’t supplied those answers. That’s the frustrating part. For users, the next useful update will need to connect the technical cause to the asset accounting and the restart decision, without asking them to infer the outcome from separate statements.

Related Listen: Who’s to Blame for How KelpDAO’s DVN Was Set Up? KelpDAO or LayerZero?