AUSD's Issuer Says Its Stablecoin 'Does Not Exist on Initia.' A Hacker Minted 2 Million There Anyway and Left With 1.4M Real Ones. The Chain Is Still Off

Agora, the company behind the AUSD stablecoin, put it plainly: “AUSD does not exist on Initia.”

Someone minted 2 million of it on Initia anyway. Then they bridged it to Ethereum and came out with 1.4 million real, fully backed AUSD.

Initia then switched off its whole network: the L1 and every rollup on it. Per Bitcoin.com, it was still stopped at block 23,365,925 on Friday night, and no restart date had been announced.

---

What Happened

Chain halted	15:41:30 UTC, Oct 23, 2026 (Initia’s official post)
What halted	Initia L1 and its rollups
Bug	”Day 0 bug” in Initia’s MoveVM on Cosmos SDK, according to the co-founder
Taken	~$2.7M in AUSD, ETH and USDC (co-founder’s estimate, not confirmed by Initia)
Native INIT affected?	No, according to the co-founder
Restart date	None announced

Security researcher Spreek spotted it first, per crypto.news: “Initia chain hacked and a bunch of tokens infiniminted… Hacker has cashed out $2.6m thus far with more in flight.”

Shortly after, co-founder Ezaan Mangalji (Zon) posted the first explanation from inside the project:

“To the best of our knowledge so far, this is a Day 0 bug related to Initia’s MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens”

He also said: “The attacker was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused.” Initia’s official account hasn’t confirmed a loss figure. Its only line so far is that it’s “working to establish the full scope of any impact with security teams, validators, and exchanges.”

---

How You Steal Tokens That Don’t Exist

This part matters beyond Initia.

D2 Finance’s on-chain breakdown, reported by Unchained and Cointelegraph, goes like this:

1. The attacker mints 2M unbacked “AUSD” on Initia. Agora says it has no contracts there, which Unchained reads as a bridged representation rather than the real token.
2. They burn those tokens and send them across LayerZero to Ethereum.
3. On Ethereum, the OFT adapter lockbox holds real AUSD. It sees a valid burn message and releases the real tokens.

D2’s one-line summary, via Unchained: “an OFT adapter cannot check whether burned tokens were ever backed.”

So the bridge did exactly what it was built to do. It just trusted the wrong side. Per D2, the attacker took:

• 1.4M AUSD, about 71% of the AUSD adapter’s balance (Unchained)
• 105 ETH, about 96% of the native-ETH adapter (Unchained)
• 1.08M USDC, which arrived as fresh mints through Circle’s CCTP (Unchained)

According to D2, $2.65M reached Ethereum within 7 minutes 21 seconds of the mint.

---

The Timeline Is the Story

All times are UTC on October 23, converted from Unchained’s ET timestamps:

• 14:59: the 2M AUSD mint on Initia
• 15:03: the attacker swaps the 1.4M real AUSD on 1inch, about 84 seconds after it arrived
• 15:27: Spreek raises the alarm publicly
• 15:41: Initia halts the chain. The same minute, the attacker sends 1,135.5 ETH (about $2.7M, so the same loot consolidated, not extra losses) to a new wallet
• 16:31: Agora freezes the attacker’s Ethereum address, per Unchained. The AUSD had been swapped out almost 90 minutes earlier

Agora’s first public statement went out at 16:57 UTC. It said it “will freeze funds related to hacker addresses.” Its second statement, per Bitcoin.com: “AUSD and Agora are unaffected. AUSD does not exist on Initia… AUSD is fully backed.”

That’s technically true. It’s also true that the AUSD sitting in that adapter is 71% lighter.

---

The Market Mostly Shrugged

According to Bitcoin.com, Upbit suspended INIT deposits and withdrawals while keeping trading open.

The token itself barely flinched. Per CoinGecko data cited by Cointelegraph, INIT briefly fell to about $0.115 and then rebounded to around $0.1496, roughly 14% up on the day. Traders seem to be betting on the co-founder’s claim that native INIT wasn’t touched.

Initia raised a $7.5M seed in February 2024, co-led by Delphi Ventures and Hack VC with Nascent and Figment Capital, per crypto.news. It’s built as an L1 hub for interconnected rollups it calls “Minitias.” When the hub stops, every Minitia stops with it.

Still unconfirmed: the exact vulnerability, which rollups and apps lost funds, Initia’s own loss figure, and when the network comes back.

---

Why This Matters for Crypto Jobs

Move isn’t a security guarantee. Move’s selling point is safe asset handling. This bug was reportedly in the VM integration (MoveVM on Cosmos SDK), not in anyone’s contract. Very few engineers know both Move internals and Cosmos SDK plumbing, and very few auditors check that seam. Anyone who does is in demand.

Bridge engineers need to think about adversarial chains. An OFT adapter that trusts any burn from a connected chain gives that chain’s weakest bug a path to your liquidity. Protocols need cross-chain security engineers who design for “what if the other side starts lying”: rate limits, per-route caps and anomaly-triggered pauses.

Seven minutes is the window. The money reached Ethereum in about 7 minutes. The public alarm came 28 minutes after the mint, and the halt 42 minutes after it. Teams that run real-time on-chain monitoring and incident response are the only ones who can act inside that window. Expect more hiring there.

Stablecoin issuers need cross-chain risk people. Agora’s contracts weren’t hacked, and a third-party adapter holding its token still lost 71% of its balance. Every issuer using LayerZero, CCTP or similar rails needs someone who owns exposure across every chain its token is bridged to, including chains where it “doesn’t exist.”

---

The Bottom Line

Nobody broke the bridge or the stablecoin. Someone broke the chain at one end of the bridge, and the bridge passed the damage along on schedule. If your token’s liquidity sits in an adapter, your security budget covers every chain connected to it.

---

Want to build the monitoring, bridge security and VM audits that catch this in the first seven minutes? Browse open security and engineering roles on Cryptogrind →