Initia stopped producing blocks at 15:41:30 UTC on October 23, 2026, about forty-two minutes after an attacker minted two million AUSD out of nothing. Because the layer-1 is built on the Cosmos SDK and runs a family of interconnected rollups called Minitias, pausing the base chain took the whole network offline rather than a single application. The first notice from the team described the shutdown as a security incident and named none of the mechanics. Those details surfaced over the following day, and together they describe a failure that is narrower than a supply shock and sharper than an ordinary bug.
A preliminary diagnosis from co-founder Ezaan Mangalji pointed to a Day 0 flaw in Initia’s implementation of MoveVM on the Cosmos SDK, meaning a bug that shipped in the original deployment. The flaw allowed the attacker to mint tokens on the Initia side without the authorization that normally precedes issuance. One boundary held: native INIT tokens were out of reach, so the incident did not dilute the chain’s own supply. What the attacker printed instead were bridged representations of other assets, and those are constrained by the real collateral sitting behind them.
That constraint is exactly where the problem migrated. Initia’s bridged assets sit behind OFT adapters, lockbox contracts that hold real tokens and release them when the matching Initia-side balance is burned. An adapter can confirm that tokens were burned; it cannot confirm that the burned tokens were ever backed. The attacker minted an unbacked claim, burned it, and collected real collateral from Ethereum. The trail, decoded by analytics firm D2 Finance, starts with a single signed transaction at 14:59:26 UTC that created the two million AUSD. Within minutes, a LayerZero message released about 1.4 million real AUSD from the Ethereum-side adapter, 105 ETH followed, and roughly 1.08 million USDC arrived through Circle’s CCTP. Most of the value was back on Ethereum within about seven and a half minutes.
Agora, the issuer of the AUSD stablecoin, drew the sharpest line. The company said it has no smart contracts deployed on Initia and that it would freeze funds tied to hacker addresses on chains where its own contracts live. The statement separates two things that share a ticker: Agora’s native AUSD on one chain, and a bridged representation of it on another. The attacker exploited the second, which is why the two million AUSD printed on Initia was never Agora’s own token.
The incident fits a pattern that Cosmos-adjacent networks have seen before; the same month, Cosmos Labs urged EVM chains to halt after a comparable mint-and-bridge exploit at KiiChain. A full halt is the bluntest tool a network has: it stops the drain but freezes every legitimate user, validator, and application in the process. Initia has not set a restart date or confirmed a final loss figure, and no post-mortem naming the exact MoveVM flaw has been published. Until one appears, the confirmed facts stay narrower than the circulating numbers: a chain was halted, a preliminary diagnosis blamed a Day-0 MoveVM bug, and roughly $2.7 million in bridged assets left for Ethereum before anyone could pause the network.
Source: BlockchainReporter.