Initia L1 halted after MoveVM mint bug let attacker create unbacked bridged tokens and drain about $2.7M to Ethereum

Summary

On 2026-10-23 Initia announced that, as of 15:41:30 UTC, the Initia L1 and Rollups had been halted due to a security incident. Initia co-founder Zon described it as a Day 0 bug in Initia's MoveVM on Cosmos SDK that let the exploiter mint additional tokens on the Initia L1, and said it does not apply to native INIT tokens. On-chain analysis by D2 Finance says one transaction at 14:59:26 UTC minted unbacked bridged tokens on Initia, which were then bridged out to Ethereum before the halt.

Affected

• Initia L1 (MoveVM on Cosmos SDK) and Initia rollups (halted)
• Bridged assets on Initia and the Ethereum-side bridge lockboxes backing them (per D2 Finance: an AUSD LayerZero OFT adapter, a native-ETH OFT adapter, and USDC via Circle CCTP)
• Fixed in: no fix or post-mortem had been published by Initia at the time of publication

Impact

Per D2 Finance, the attacker's key called a single Move function to mint 2,000,000 units of the Initia-side LayerZero OFT version of AUSD (and, consistent with the same function, USDC and ETH). Valid bridge messages then released about 1.4M AUSD and 105 ETH from Ethereum adapters, and about 1.08M USDC was minted on Ethereum via CCTP, for about $2.65M back on Ethereum within 7m21s of the mint. All proceeds were swapped to ETH, and D2 Finance reports that about 1,135.52 ETH (~$2.73M) sits in a fresh wallet. Zon told The Block the attacker minted and bridged out about $2.7M of AUSD, ETH and USDC before the chain was paused. Researcher Spreek initially estimated $2.6M cashed out. Agora (AUSD issuer) states that no Agora-issued AUSD was minted on Initia; D2 Finance corrected its analysis accordingly, and says the loss sits with the depositors of the third-party AUSD OFT adapter. Initia has not confirmed the total loss or published a root cause. Exploitation in the wild is confirmed.

Recommended actions

• Do not bridge assets to or from Initia or its rollups until Initia publishes verified information through its official channels.
• Exchanges and bridges: screen deposits against the attacker and proceeds addresses listed in this advisory.
• Ignore unofficial "refund", "claim" or recovery links; Initia warned about unofficial messages during the incident.

Source & attribution

This 0xCERT advisory summarises Initia's incident notice (https://x.com/initia/status/2113661738625155217), a statement by Initia co-founder Zon (https://x.com/ItsAlwaysZonny/status/2113667290059190466), on-chain analysis by D2 Finance (https://x.com/D2_Finance/status/2113667420359700509, with transaction receipts at https://x.com/D2_Finance/status/2113668162638242225), Agora's clarification (https://x.com/withAUSD/status/2113681155585368432), reporting by The Block (https://www.theblock.co/news/defi/2026-10-23-initia-halts-network-after-security-incident-attacker-reportedly-mints-tokens-427755), and the DeFiLlama hacks database (https://defillama.com/hacks). Details may change; refer to the original sources for the authoritative record.