Initia halted its layer-1 blockchain and connected rollups on October 23 after an attacker allegedly exploited a token-minting flaw and converted unbacked tokens into Ether (ETH).
The project confirmed the shutdown at 15:41 UTC, saying it was investigating the incident with validators, exchanges and security firms. Blockchain analysts traced transactions across multiple networks, highlighting how flaws in token-minting controls can expose assets held by cross-chain bridges.
D2 Finance traced the exploit to a transaction at 14:59:26 UTC that allegedly created 2 million AUSD tokens without sufficient backing. About 153 seconds later, a LayerZero message triggered the release of 1.4 million AUSD from an adapter on Ethereum.
According to D2 Finance’s analysis, the attacker also obtained approximately 1.08 million USDC through the unauthorized minting of tokens.
D2 Finance said the attacker swapped the stablecoins for Ether (ETH) through 1inch and 0x. The transactions reportedly drained assets from several bridge adapters.
The attacker subsequently consolidated 1,135.52 ETH, worth approximately $2.73 million, in a newly created wallet, according to the firm’s analysis. The amount represents the assets traced to that wallet, rather than a confirmed final loss figure for Initia.
The incident highlights a risk in cross-chain bridges: weaknesses in token-minting controls can allow attackers to exchange unbacked tokens for assets with real market value.
D2 Finance compared the exploit with September’s Liquid incident, in which a software bug reportedly enabled the creation of unbacked L-BTC and withdrawals of real bitcoin. Initia has yet to disclose the full extent of the incident’s financial impact.
