Initia Halts Layer-1 and Rollups After Exploit Drains About $2.7M
An attacker minted 2 million unbacked AUSD on Initia and bridged about $2.7M to Ethereum before the team halted its layer-1 and rollups. Co-founder Zon points to a Day 0 bug in the MoveVM implementation that does not affect native INIT.
An attacker minted tokens without backing on Initia and bridged roughly $2.7 million out to Ethereum before the team paused its layer-1 blockchain and its rollups on Friday. The network was halted at 3:41 p.m. UTC, according to Initia's post on X, which said the team is investigating with security teams, validators and exchanges.
Security researcher Spreek first flagged the problem on X, reporting unauthorized minting and about $2.6 million already converted into other assets, with more funds still moving.
D2 Finance then published a breakdown of the mechanics. By its account, the attacker exploited a vulnerability in a Move function to mint 2 million AUSD without sufficient backing. Cross-chain transfers followed, pulling about 1.4 million AUSD, 105 ETH and 1.08 million USDC over to Ethereum. The proceeds were consolidated into an Ethereum wallet holding about 1,135.5 ETH, which D2 valued at $2.73 million.
Co-founder Ezaan Mangalji, known as Zon, offered the closest thing to an official account. He said preliminary findings point to a previously unknown "Day 0" bug, meaning a flaw nobody knew about before it was used, in the network's MoveVM implementation on Cosmos SDK. It allowed unauthorized minting but does not apply to native INIT tokens, he said.
"The attacker was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused,"
Ezaan Mangalji (Zon), Initia co-founder
The loss figures differ slightly by source: $2.6 million from Spreek, $2.7 million from Zon, and $2.73 million from D2's valuation of the ETH wallet. Initia has not formally confirmed an amount or the precise cause, and it has not said when the network will come back online.
INIT's price whipsawed. According to CoinGecko data, the token dropped to about $0.115 on Friday, then rebounded above $0.15 and traded near $0.1496, up about 14% over 24 hours. The recovery tracks Zon's statement that the flaw did not touch native INIT, though that remains a preliminary team assessment.
Initia is built as a layer-1 that supports a network of interconnected rollups called Minitias, and the halt covers both the base chain and those rollups. For now, the questions that matter most to users, how far the damage extends and when activity resumes, are still open while the team works with researchers, validators and exchanges to determine the full impact.
