Initia halted its Layer 1 blockchain and rollups after a security incident that let an attacker mint tokens without authorization. Co-founder Zon put the amount bridged out at ~$2.7m, while stablecoin issuer Agora disputes that any AUSD was minted on Initia.
Initia, a blockchain built to support interconnected chains, halted its Layer 1 blockchain and rollups on Friday after a security incident. The project says it is investigating the reach of the incident alongside security teams, validators, and exchanges.
Co-founder points to a "Day 0" bug
Co-founder Ezaan Mangalji, who goes by Zon, said preliminary findings pointed to a previously unknown "Day 0" bug in the network's MoveVM implementation on Cosmos SDK. According to Zon, the flaw allowed unauthorized token minting but "does not apply to native INIT tokens."
Zon said the attacker was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused. Blockchain researcher Spreek initially estimated that the attacker had cashed out roughly $2.6 million and had more funds in transit. Initia has not confirmed the amount lost.
Agora disputes the AUSD account
Agora said on Oct. 23 that a third-party product using its AUSD stablecoin on Ethereum was hit by the incident. The issuer said the AUSD smart contract is not deployed on Initia and that no AUSD was minted there. Agora did not name the affected product.
An Ethereum transaction shows 1.4 million AUSD transferred from a bridge adapter address to another address that D2 Finance identified in its attack analysis. The transaction records a transfer of existing AUSD alongside an OFTReceived bridge event, rather than a mint of new AUSD on Ethereum. D2 Finance had described the Initia-side transaction as minting 2,000,000 AUSD.
Agora also said it would freeze funds at hacker-related addresses holding AUSD on chains where its contracts are deployed. The recipient address had already swapped the 1.4 million AUSD for about 581.56 ETH before that pledge.
INIT reverses its drop
Initia's native INIT token fell 14% immediately after the exploit was reported, before reversing the losses. The token was up 14% on the day at the time of The Block's update.
Sources: The Block, The Defiant
Trading involves risk.
Risk Disclaimer
