Initia: A Hidden Bug Printed $2M of Fake Dollars, and $2.7M Got Away

At 14:59:26 UTC on Friday 23 October 2026, a single transaction on Initia, a small blockchain, put 2,000,000 digital dollars into a wallet that had paid nothing for them. Two and a half minutes later, 1.4 million real dollars' worth of the same coin arrived at the same address on Ethereum, the second-largest blockchain. Eighty-four seconds after that, they had been swapped for ether. According to a reconstruction by the trading firm D2 Finance, about $2.65 million had left Initia within seven minutes and 21 seconds of the first transaction.

Initia stopped its network at 15:41:30 UTC, 42 minutes after the mint. A blockchain halt works like a stock exchange suspending trading: nothing moves until the operators switch it back on. By then the money had gone. Ezaan Mangalji, the Initia co-founder who goes by Zon, put the haul at about $2.7 million in AUSD, ETH and USDC. Initia itself has not confirmed a final loss, and on the morning of 24 October the chain was still stopped.

Initia went live in April 2025 as a "layer 1" with rollups attached. The layer 1 is the main road; the rollups, which Initia calls Minitias, are toll lanes feeding it, smaller networks run by individual apps. The project was started by two former Terraform Labs developers, Zon and Stan Liu, and raised a $7.5 million seed round in February 2024 co-led by Delphi Ventures and Hack VC. Binance was the first exchange to list its token, INIT, which peaked at $1.42 in May 2025, according to CoinGecko. Just before the attack it traded at about $0.135.

How a chain prints money

Every blockchain has an engine that runs its programs. Initia's is the MoveVM, its own version of Move, a system first built at Facebook for the abandoned Libra currency and later adopted by the Aptos and Sui networks. Initia runs it on the Cosmos SDK, a widely used kit for building blockchains.

Zon blamed a "Day 0" bug in that engine, meaning a flaw nobody knew existed until it was used. It let the attacker create extra tokens on the main chain, he said, but did not affect INIT itself. No keys were stolen. Initia's public transaction records show a short program, signed with the attacker's own key, that the engine accepted and that created 2 million tokens. D2 Finance found the recipient, the token and the amount were simply settings in that program, which fits one wallet printing AUSD, USDC and ether at will.

AUSD is a stablecoin, a digital dollar meant to be worth exactly $1, issued by a company called Agora. But the AUSD on Initia was not Agora's coin. It was a mirror created by a bridge, and a bridge works like a currency exchange booth between two networks. Hand over real AUSD on Ethereum and the booth locks it in a drawer and issues the same amount of Initia AUSD. Hand the Initia version back and it is destroyed, and the booth pays out real AUSD from the drawer. This booth ran on LayerZero, a service that carries those instructions from one chain to the other.

The design has one blind spot, and D2 Finance named it. The booth on Ethereum checks that the tokens were really destroyed on Initia. It does not check whether they were ever real. The attacker fed the unbacked AUSD, digital dollars printed with nothing behind them, back through the booth. LayerZero's checkers confirmed, correctly, that the tokens had been destroyed, and the drawer paid out 1.4 million real AUSD, 71% of everything in it, leaving about 576,000. A second booth, for ether, gave up 105 ETH, 96% of its holdings. Another 1.08 million USDC, the digital dollar issued by Circle, reached Ethereum through CCTP, Circle's own service for moving USDC between networks.

©CMZ chart. Data: D2 Finance, Cointelegraph, Ethereum records

D2 compared it to the Liquid Network exploit on 6 September, when a flaw in Blockstream's software created 4,000 bitcoin from nothing on a sidechain and a valid withdrawal paid out 3,996 real ones.

Seven minutes and 21 seconds

The preparation started six and a half hours earlier. At 08:26 UTC the attacker's Ethereum address received about 0.1 ether, roughly $240, from Tornado Cash, a mixer that pools coins so their origin cannot be traced. From 13:14 UTC it made a few tiny transfers through Axelar, another cross-chain service. At 14:37 it put 0.006 ether into the same ether booth it would empty 29 minutes later. The same address, starting 0xDD92, appears on both Initia and Ethereum.

After the mint, the real AUSD landed on Ethereum at 15:01:59 and was sold for 581.6 ether through 1inch, a service that finds the best price across trading venues, as a broker routes an order. A million USDC followed the same way. The 105 ether arrived at 15:06:47. A last 80,000 USDC came through at 15:25 and was swapped through 0x, a similar service. D2 found every stablecoin was ether within three minutes of landing.

The speed was the point. Agora and Circle can freeze their coins at a given address, as a bank freezes an account. Ether has no such switch.

At 15:27 UTC Spreek, a pseudonymous security researcher, posted that Initia had been hacked and "a bunch of tokens infiniminted", with $2.6 million already cashed out. Fourteen minutes later the chain stopped. Its last block, number 23,365,925, carries the timestamp 15:41:30. Five seconds later, all 1,135.52 ether, worth about $2.73 million, moved to a fresh wallet on Ethereum.

Who is left holding it

Agora moved first to say it was not the victim. At 16:31 UTC it froze the attacker's first Ethereum address, which by then held no AUSD. It said it has no contracts on Initia, that AUSD "does not exist on Initia" and that its coin is fully backed. D2 corrected its first account to match: no Agora-issued AUSD was created, and the 1.4 million that left was real AUSD held in a third party's drawer.

That leaves the people on the other side of the booths. The AUSD and ether that left Ethereum were the reserves behind tokens users still hold on Initia, which are now backed by a fraction of their value. Initia has not said who ran the drained bridge contracts, who will make up the difference, or whether anyone will be repaid.

Upbit, South Korea's largest exchange, suspended INIT deposits and withdrawals at 00:57 Korean time on 24 October, 15:57 UTC, citing signs of a security incident, and 17 minutes later posted a notice urging caution over price swings. INIT fell about 14% in ten minutes, to $0.116 on CoinGecko's figures, then climbed back above $0.15 by 17:00 UTC.

By D2's count, Initia's own trading market had handled about $334,000 of trades in the previous 24 hours. The bridges moved eight times that for one wallet in seven minutes.

What a halt can and cannot do

Stopping the chain stopped further printing. It cannot recall money that has already left. Initia's validators, the independent operators who keep the network running, can patch the engine and restart it, or even rewind the chain to before the mint, as Harmony did in August when it erased 109,000 transactions to undo a forgery. None of that reaches Ethereum, where the 1,135.52 ether sits in the attacker's wallet, starting 0x358e. By the morning of 24 October it had not moved.

Others have noticed it. Within an hour, strangers were sending the wallet tiny payments with messages attached, one asking for a couple of thousand dollars and promising to pay it back. Scammers planted fake "ETH" transfers in the first address's history, pointing to lookalike copies of the new wallet, in the hope that the thief would one day copy the wrong one. Initia had made no public bounty offer, on X or on-chain.

In July the security firm Hexens disclosed a flaw in the Move engine of Aptos that could have let an attacker counterfeit the right to mint stablecoins. It was reported privately and fixed at no cost to anyone. Initia's engine is a separate implementation, and nobody has said the two bugs are related.

Initia's last word, as of 24 October, is still its first: the network is halted, it is working with security firms, validators and exchanges, and users should beware of unofficial links. There is no post-mortem, no repayment plan and no restart date.