Initia Network Crippled: $2.7M Cross-Chain Exploit Exposes Critical Flaw

At 11:41 AM EST on October 23, the Initia Layer1 network and its associated rollups were abruptly halted due to a major security incident. By 5:52 PM that day, no timeline for network restoration had been provided. This sudden shutdown revealed a critical vulnerability in the network's foundational architecture.

The Root Cause: A MoveVM Zero-Day Exploit

According to initial analysis by Initia co-founder Zon, the attack exploited a "Day 0" vulnerability within Initia's MoveVM, which is built on Cosmos SDK. This flaw enabled the attacker to mint unauthorized tokens on the Initia L1—notably, the native INIT token remained unaffected.

During a brief window before chain operations were suspended, the attacker successfully minted and transferred approximately $2.7 million worth of various crypto assets, including AUSD, ETH, and USDC.

The Attack Timeline: $2.7M in 7 Minutes

Blockchain analytics firm D2 Finance traced the attacker's movements:

  • Step 1: The Mint – At 10:59 AM on October 23, the attacker minted 2 million AUSD tokens in a single transaction.
  • Step 2: Cross-Chain Transfer – The minted tokens were bridged to Ethereum via LayerZero's OFT adapter for settlement in a lockbox contract.
  • The Critical Flaw: The OFT adapter failed to validate whether the burned tokens had proper backing.

Asset Flow Analysis

Within just 7 minutes and 21 seconds, the attacker executed multiple transfers:

  • Withdrew 1.4 million AUSD (71% of the adapter's total)
  • Transferred 105 ETH (96% of the adapter's total)
  • Minted 1.08 million USDC via Circle's CCTP

These assets, valued at approximately $2.65 million, all flowed to the Ethereum network. The attacker's address subsequently moved 1,135.5 ETH (worth ~$2.7M) through 1inch before being frozen.

Fallout and Industry Response

Stablecoin issuer Agora released a statement clarifying that AUSD was never officially deployed on the Initia network and that all circulating AUSD tokens are fully backed. This move aimed to distance the stablecoin from the exploit and maintain its credibility.

The security incident resulted in significant financial losses and raised serious questions about the Initia network's reliability. The Layer1 shutdown directly impacts all DApps and user assets within its ecosystem, requiring substantial security improvements and time to rebuild user trust.