A Bug Minted 2 Million Unbacked AUSD on Initia. The Ethereum Bridge Verified the Burn, Not the Backing

What Happened

At 15:41:30 UTC on Friday, October 23, Initia stopped. 'The Initia L1 and Rollups have been halted due to a security incident,' the project's account posted. Initia is a layer 1 built on the Cosmos SDK that runs the Move virtual machine; it launched in April 2025 as the hub for a set of rollups it calls Interwoven, so the halt stopped the whole network.

Security researcher Spreek had flagged the exploit about an hour earlier: unauthorized minting, about $2.6 million cashed out, and a warning that 'AUSD and similar is unbacked on initia right now.' Co-founder Zon said preliminary findings pointed to a previously unknown bug, which he called 'Day 0,' in Initia's own Move virtual machine, and that INIT, the native token, was not affected.

As of Friday evening there was no restart date, no confirmed loss total, and no confirmed root cause.

The fullest public reconstruction is D2 Finance's, and Initia has not confirmed it. A signed transaction at 14:59:26 UTC created 2 million AUSD on Initia with no backing. AUSD is a dollar stablecoin issued by Agora, with reserves managed by VanEck and held at State Street. About 153 seconds after the mint, a valid message through LayerZero released 1.

4 million real AUSD from the adapter contract on Ethereum, about 71% of what it held; D2's explanation is that the adapter had no way to tell whether the tokens burned on Initia had ever been backed. The attacker also drew 105 ETH, about 96% of the native-ETH adapter's balance, and about 1.

08 million USDC, D2 says, then consolidated about 1,135.5 ETH (about $2.73 million) in 1 new wallet. Agora's response, as The Defiant reported it: its contracts were not compromised, it has none on Initia, AUSD remains fully backed, and it would freeze attacker-linked funds on networks where its contracts are deployed.

It then froze 1 Ethereum address, which had swapped its 1.4 million AUSD for ETH through 1inch at 15:03:23 UTC, more than an hour earlier.

The verifiers saw a real burn and the adapter paid what the message said. Nothing in a bridge asks whether the tokens on the far side were ever backed, and Friday priced that question: $1.4 million in 153 seconds.

The Adapter Pays Whatever a Verified Message Names

LayerZero's OFTAdapter, the standard way an existing ERC-20 is made to move across chains, holds the real tokens on their home chain. Sending locks them: the debit path moves tokens 'into this contract from the caller.' Receiving releases them: the receive path reads a recipient and an amount out of the message and transfers that amount; the comment above it says only 'Unlock the tokens and transfer to the recipient.'

Between those steps sit LayerZero's decentralized verifier networks (DVNs), which confirm that the source chain emitted the packet. That is all they confirm. Whether the AUSD burned to produce the packet had ever been backed by AUSD locked on Ethereum is a question about Initia's execution, and nothing in the message path asks it.

The design assumes the far side burns only what it once minted against a lock. On Friday the far side's virtual machine let someone mint without the lock.

That separates Friday from this year's other unbacked-mint bridge incidents. On Monday, April 13, a forged message gave an attacker admin control of Hyperbridge's bridged DOT contract on Ethereum, and about $237,000 came out before the pool ran dry: the bridge's proof verification failed.

On the night of Friday, August 21, an attacker took over the LayerZero delegate role on The Sandbox's SAND contract on Base and drained about 14.75 million real SAND (about $675,000) from the Ethereum adapter: the bridge's permission model failed. On Initia nothing in the bridge failed: the DVNs saw a real burn and said so, and the adapter paid what the message named.

The weak point was the virtual machine 1 layer down, and a bridge's whole design is to take that layer's word about its own state. The Liquid federation's September payout for L-BTC that never existed had the same shape: every key held, and the floor under the asset was the sidechain's accounting.

Three Switches, One Hour, Nothing Recovered

3 protective mechanisms fired after the money moved, and each reached its own territory and no further. Agora's freeze is issuer control written into AUSD's contracts, and it is real: the frozen address cannot move AUSD on Ethereum again. But it reaches only chains where Agora's contracts live, and Agora says it has none on Initia.

The unbacked 2 million sit beyond the issuer's switch, and the 1.4 million real ones were ETH an hour before it was thrown. Initia's halt is the strongest switch a chain has, and the team used it: every chain in the network stopped, freezing whatever the attacker still held there and every other user's balance with it.

Upbit's suspension of INIT deposits and withdrawals at 15:57 UTC, per Unchained, did for 1 exchange's customers what the halt did for everyone else.

The case for each switch is sound. Letting a virtual machine that mints on demand keep producing blocks is worse than a halt; Cosmos Hub validators made a similar call on September 22, stopping their own chain to trap about 1.2 million ATOM an attacker had moved onto it. A freeze that reached Initia would have required Agora to run a contract there, a different product with its own risks.

The point is the order of events. The attacker's private keys moved funds at 14:59, 15:02, and 15:03; the first protective action landed at 15:41, and the issuer's some time after 16:03. Every switch in this story is slower than a signature and scoped to a ledger its operator controls.

The 1,135 ETH ended Friday in a wallet none of the 3 operators can touch.

What This Means for You

First, what you hold on a chain is what that chain's contracts say you hold; whether anyone else honors it is their decision. AUSD on Initia was never Agora's liability. It was a LayerZero representation backed only by AUSD locked in an adapter on Ethereum, and the adapter knew of Initia only what Initia's virtual machine told it.

'Fully backed' was true all day on Friday, about a reserve account at State Street. It said nothing about the token in an Initia wallet. The same structure stands behind most bridged assets you could hold, wrapped bitcoin included: a claim on an adapter, which is a claim on the integrity of every chain the adapter listens to.

Exposure to the asset is not ownership of it, and the gap between them is the weakest virtual machine in the message path.

Second, the switches. Issuer freeze authority cuts both ways: it locked the leftover AUSD, it makes any issued stablecoin a conditional balance, and on Friday it reached nothing that mattered because the issuer had no contract where the damage was done. A chain halt protects the chain, not you.

Your private keys were yours all afternoon, and nothing they sign on Initia will confirm until a team you did not choose decides to restart. Self-custody of a bridged token on a halted chain is custody of a frozen number. That is where the thesis stops: holding your own keys removes the custodian.

It does not remove the bridge, the issuer, or the operator of the chain the token lives on.

Third, the actions. For every asset you hold off its native chain, write down who issued it natively, how it crossed, and who can mint it on the far side. If the issuer did not deploy it there (Agora says AUSD is live on 15 networks; Initia is not one), you hold a third party's representation, and the issuer's backing and freeze both stop at that line.

Size bridged positions as counterparty exposure, not as the asset. Keep what you mean to keep on the chain that issued it: bitcoin on Bitcoin was the 1 position in this story that no switch could have frozen and no mechanism could have inflated. And when a chain you use halts, read it as information: your assets there now wait on a restart decision.

The attacker's, as a rule, do not.

What to Watch

Initia's post-mortem is the first checkpoint: whether the bug sits in Initia's own Move virtual machine, as Zon's preliminary account has it, or in code shared with other Move chains. The restart will show how the team treats the unbacked AUSD still on Initia. LayerZero publishes a RateLimiter contract an application can inherit to cap outflows over a time window; whether the AUSD adapter used one is the design question left open.

The 1,135 ETH will move, and where it lands decides whether 'about $2.7 million' ends as a recovery or a write-off. And a second protective layer inverted the same week, 1 chain over: Arkadiko, a lending protocol on Stacks, said on Thursday, October 22 that a malicious contract had passed its governance vote and then drained most of its vault collateral, about 2 million stSTX and 1.

65 sBTC by its preliminary count, per The Crypto Times's account of the team's post; no post-mortem or attacker address has been published, so the figures are unverified. The shape is Friday's: the mechanism did what it was written to do, and that is what moved the money.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.