Developers of the L1 blockchain Initia suspended the mainnet and associated rollups following a security breach. Co-founder Ezaan Mangalji estimated the loss at approximately $2.7 million. The exploit originated from a zero-day vulnerability in the integration between MoveVM and the Cosmos SDK, which allowed the attacker to mint unbacked tokens.
Data from D2 Finance indicates the attacker minted 2 million AUSD without collateral. Through cross-chain bridges, the perpetrator extracted 1.4 million AUSD, 105 ETH, and 1.08 million USDC. These assets were consolidated into a single wallet, totaling 1,135.5 ETH valued at $2.73 million. Bitquery clarified that the attacker exploited bridge reserves by minting fake copies of assets.
While the attacker generated tokens with a nominal value of $7.48 million, most could not be withdrawn, including $3 million in the internal iUSD stablecoin. Agora, the issuer of AUSD, confirmed its native asset remains fully backed, noting that only the bridge-wrapped copy was affected. The INIT token price briefly dropped 14% to $0.115 before recovering.
In response to the incident, South Korean exchanges Upbit and Bithumb suspended deposits and withdrawals for INIT. The development team has not provided a timeline for the network restart or a technical report regarding potential user compensation or asset recovery.
