-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0267 ============================================================ Advisory-ID: 0xCERT-2026-0267 Severity: High Published: 2026-10-23T16:00:03.000Z Updated: 2026-10-24T07:23:32.190Z Chains: Ethereum, Other / Multi-chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0267 Title: Initia L1 halted after MoveVM mint bug let attacker create unbacked bridged tokens and drain about $2.7M to Ethereum Summary - ------- On 2026-10-23 Initia halted its L1 and rollups after an attacker minted unbacked bridged tokens on Initia and redeemed them via LayerZero and CCTP for about $2.6M-$2.7M of AUSD, ETH and USDC on Ethereum. Initia says native INIT is not affected. Do not bridge to or from Initia until the team confirms a fix. Details - ------- Summary On 2026-10-23 Initia announced that, as of 15:41:30 UTC, the Initia L1 and Rollups had been halted due to a security incident. Initia co-founder Zon described it as a Day 0 bug in Initia's MoveVM on Cosmos SDK that let the exploiter mint additional tokens on the Initia L1, and said it does not apply to native INIT tokens. On-chain analysis by D2 Finance says one transaction at 14:59:26 UTC minted unbacked bridged tokens on Initia, which were then bridged out to Ethereum before the halt. Affected - - Initia L1 (MoveVM on Cosmos SDK) and Initia rollups (halted) - - Bridged assets on Initia and the Ethereum-side bridge lockboxes backing them (per D2 Finance: an AUSD LayerZero OFT adapter, a native-ETH OFT adapter, and USDC via Circle CCTP) - - Fixed in: no fix or post-mortem had been published by Initia at the time of publication Impact Per D2 Finance, the attacker's key called a single Move function to mint 2,000,000 units of the Initia-side LayerZero OFT version of AUSD (and, consistent with the same function, USDC and ETH). Valid bridge messages then released about 1.4M AUSD and 105 ETH from Ethereum adapters, and about 1.08M USDC was minted on Ethereum via CCTP, for about $2.65M back on Ethereum within 7m21s of the mint. All proceeds were swapped to ETH, and D2 Finance reports that about 1,135.52 ETH (~$2.73M) sits in a fresh wallet. Zon told The Block the attacker minted and bridged out about $2.7M of AUSD, ETH and USDC before the chain was paused. Researcher Spreek initially estimated $2.6M cashed out. Agora (AUSD issuer) states that no Agora-issued AUSD was minted on Initia; D2 Finance corrected its analysis accordingly, and says the loss sits with the depositors of the third-party AUSD OFT adapter. Initia has not confirmed the total loss or published a root cause. Exploitation in the wild is confirmed. Recommended actions - - Do not bridge assets to or from Initia or its rollups until Initia publishes verified information through its official channels. - - Exchanges and bridges: screen deposits against the attacker and proceeds addresses listed in this advisory. - - Ignore unofficial "refund", "claim" or recovery links; Initia warned about unofficial messages during the incident. Source & attribution This 0xCERT advisory summarises Initia's incident notice (https://x.com/initia/status/2113661738625155217), a statement by Initia co-founder Zon (https://x.com/ItsAlwaysZonny/status/2113667290059190466), on-chain analysis by D2 Finance (https://x.com/D2_Finance/status/2113667420359700509, with transaction receipts at https://x.com/D2_Finance/status/2113668162638242225), Agora's clarification (https://x.com/withAUSD/status/2113681155585368432), reporting by The Block (https://www.theblock.co/news/defi/2026-10-23-initia-halts-network-after-security-incident-attacker-reportedly-mints-tokens-427755), and the DeFiLlama hacks database (https://defillama.com/hacks). Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://x.com/initia/status/2113661738625155217 - - https://x.com/ItsAlwaysZonny/status/2113667290059190466 - - https://x.com/D2_Finance/status/2113667420359700509 - - https://x.com/D2_Finance/status/2113668162638242225 - - https://x.com/withAUSD/status/2113681155585368432 - - https://www.theblock.co/news/defi/2026-10-23-initia-halts-network-after-security-incident-attacker-reportedly-mints-tokens-427755 - - https://defillama.com/hacks - - https://www.blockchainbreaches.com/en/breaches/initia-2026 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmrcdzUJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmembn+Plg9xZ85qXGPoTyHtHgvlGESYncejlx/W twXdlBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAsPgEA1ldWIlnPnRUGSljT j8RaEksndHnEi1txf4+dLebTHQoBAODrgKqLjIX9GpBjk0WG43u3ncR1f5yE 2H0Ah1lax8MG =9ZZo -----END PGP SIGNATURE-----