Initia is investigating with security teams, validators and exchanges. D2 Finance traced about $2.65 million in transfers in its initial analysis; Initia has not confirmed total losses.
Initia halted its mainnet and rollups on October 23 following a security incident. The team said the halt began at 15:41:30 UTC. It is working with security teams, validators and crypto exchanges to establish which assets were affected and the full scope of the incident. The announcement did not give a final loss figure or a restart schedule.
D2 Finance reported that it traced assets worth about $2.65 million to Ethereum. The firm subsequently corrected its initial description of a “2 million AUSD” mint: the tokens were a third-party LayerZero OFT representation on Initia, not AUSD issued by Agora. Agora also said it has no smart contracts deployed on Initia.
Agora’s AUSD and the bridge representation are different
Agora’s response says the affected product is operated by a third party and uses AUSD on Ethereum. In a correction posted at 17:47 UTC, D2 Finance acknowledged that Agora-issued AUSD supply was unchanged. It said the 1.4 million tokens released from the Ethereum lockbox were real AUSD. In D2’s corrected account, the attacker created a token representation on Initia and then caused existing AUSD to be released on Ethereum.
In a further statement at 18:26 UTC, Agora said its AUSD deployments on all networks and its operations continued normally. The company said AUSD remained fully backed and directed readers to its official contract list. Initia is absent from the ten mainnet networks listed; testnet addresses appear in a separate table.
LayerZero’s February 21, 2024 explanation of OFT describes the OFTAdapter model for an existing token: the adapter locks the original token on one chain, and a contract on the other chain creates its representation. Burning that representation on the return journey can release the locked asset. For a blockchain bridge using this model, the network, contract and location of the underlying asset all matter when identifying tokens with the same name. A separate contract manages the representation of a dollar-tracking stablecoin on another chain.
Total losses have not been confirmed. D2 Finance’s estimate of roughly $2.65 million transferred comes from its initial technical analysis. The firm later reported 1,135.52 ETH, valued at about $2.73 million, in another address. That balance was measured at a different point in the sequence. The figures should not be added to calculate a loss; Initia has not published a final breakdown.
Preliminary tracing identifies three transfer routes
D2 Finance’s analysis says a transaction at 14:59:26 UTC created 2 million units of the third-party AUSD representation on Initia. Ethereum’s adapter released 1.4 million AUSD 153 seconds later, at 15:01:59 UTC. The firm calculated that roughly $2.65 million reached Ethereum through AUSD, ETH and USDC within 7 minutes and 21 seconds of the first transaction. The amounts below are D2’s findings, rather than a final loss statement approved by Initia.
| Asset | Reported amount | Route and remaining balance |
|---|---|---|
| AUSD | 1.4 million | AUSD OFT adapter: about 71% of its balance left, with 576,000 AUSD remaining. |
| ETH | 105 ETH | Native ETH OFT adapter: about 96% left, with 4.84 ETH remaining. |
| USDC | 1.08 million | Recorded as newly minted tokens on Ethereum through Circle CCTP. |
Circle’s CCTP documentation explains that native USDC transfers burn tokens on the source chain and mint the corresponding amount on the destination chain. An Ethereum mint record alone therefore does not establish an unbacked increase in Circle’s total supply. Initia has not yet explained where authorization failed in the exit route described by D2.
The transaction opened in Initia’s explorer is marked successful at 14:59:26 UTC on October 23, in block 23,364,847. It shows 135,888 gas used, a 0.5 INIT fee and one MsgScript call. The page shows when the transaction ran and what it consumed. It does not identify the failed authorization check. The Ethereum transfer amounts reported here are attributed to D2’s published tracing.
The firm argues that a single Move call signed with the attacker’s own key could create tokens, without a bridge message in the initial mint. According to D2, the decentralized verifier networks (DVNs) that check LayerZero messages subsequently confirmed real burn events. The Ethereum adapter could not check whether the representation had backing when it was first created. Initia has not published a root-cause report. The team’s statement does not confirm a vulnerability in LayerZero message verification or Circle’s CCTP system.
D2 also described preparatory transfers: 0.1 ETH from Tornado Cash at 08:27 UTC, a small transfer through Axelar Handler at 13:14, and a 0.006 ETH deposit at 14:37 into the adapter later drained. According to its tracing, the attacker converted the stablecoins to ETH through 1inch and 0x within three minutes of the exits. The AUSD conversion took 84 seconds. The 1,135.52 ETH it reported in a fresh address was an observation at the time of its post, not an amount announced as frozen or recovered.
The halt covers the mainnet and application networks
Initia’s architecture documentation describes the mainnet as a hub for liquidity, interoperability and coordination. Its rollups can choose virtual machines, gas tokens and features to suit individual applications. The team halted both the mainnet (L1) and rollups, rather than only closing a bridge interface. The announcement does not provide an application-by-application breakdown of affected assets.
Initia’s October 23 announcement“the Initia L1 and Rollups have been halted”
Initia’s official halt announcement, posted October 23 at 16:00 UTC
The post loads from X when you open it.
For background on the rollup design, the 5:25–7:28 section of Encode Club’s January 23, 2025 workshop introduces Initia’s interwoven rollups. The workshop was published about 21 months before the incident and explains the network’s architecture; it contains no findings about the attack.
Agora plans freezes but reports no recovered amount
In a separate statement at 16:57 UTC, Agora said its security team was monitoring the incident and would freeze hacker-related AUSD funds on chains where AUSD or Agora contracts are deployed. The company has not said it froze funds, recovered money or paid users. Its stated plan concerns AUSD on those chains, not a promise to recover all assets the attacker converted into ETH.
Initia said it would share verified information through its official channels and warned users about unofficial links, messages and claims. Recovery or compensation links circulated after the incident can expose users to phishing. The team has not shared a compensation application form.
