Developers of the modular blockchain Initia halted the network and its rollups, smaller blockchains built on top of it, on Friday after an attacker exploited a bug to mint tokens without backing, co-founder Ezaan Mangalji said.
Mangalji said the attacker used a previously unknown flaw in the MoveVM virtual machine, which runs on the Cosmos SDK, to mint 2 million units of the dollar-pegged stablecoin AUSD. The attacker then moved about 1.4 million AUSD, 105 ETH and 1.08 million USDC to Ethereum through LayerZero, a bridge that transfers tokens between different blockchains. Mangalji put the total amount moved out at about $2.7 million. Spreek, an independent security researcher who first flagged the attack, estimated the loss at $2.6 million.
Mangalji said: “The attacker was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused.” He said the bug did not affect INIT, the network's native token.
Agora, the issuer of AUSD, said the stablecoin remained fully backed despite the unauthorized minting. South Korean exchange Upbit temporarily suspended INIT deposits and withdrawals and warned traders of the risk, and KuCoin halted trading in the token the next day, citing maintenance.
As of publication, Initia had not set a date to restart the network or published a formal report on the cause of the breach. Mangalji said the investigation was continuing with validators, exchanges and security partners.
