Anyone holding assets on Initia is waiting on a restart. Initia’s layer 1 and its rollups have been offline since 11:41 a.m. ET on Friday, when the team cited a “security incident,” and it had not said when they would come back as of 5:52 p.m. ET. Initia said in the same notice that it was working “to establish the full scope of any impact with security teams, validators, and exchanges.”

Co-founder Zon pointed to Initia’s own software, citing preliminary findings. He wrote that it was “a Day 0 bug related to Initia’s MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens.” The attacker managed to “mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused,” he added.

Pseudonymous researcher Spreek flagged the attack at 11:27 a.m. ET, 14 minutes before the halt, estimating $2.6 million cashed out.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

How the Funds Left

D2 Finance, which published a breakdown of the transactions, said one transaction at 10:59 a.m. ET minted 2 million AUSD on the Initia side. By D2’s account, those unbacked tokens were burned and sent over LayerZero to Ethereum, where OFT adapters, lockbox contracts holding the real tokens behind Initia’s bridged versions, paid out. D2 wrote that “an OFT adapter cannot check whether burned tokens were ever backed.”

D2 said the attacker pulled 1.4 million AUSD, 71% of the AUSD adapter’s holdings, leaving about 576,000, plus 105 ETH, 96% of the native-ETH adapter. Another 1.08 million USDC arrived as new mints through Circle’s CCTP. In D2’s telling, $2.65 million had reached Ethereum within seven minutes and 21 seconds of the mint.

Agora Says AUSD Is Unaffected

Agora, which issues AUSD, said at 12:57 p.m. ET that it “has no smart contracts deployed on Initia.” At 2:26 p.m. ET it added that “AUSD does not exist on Initia,” and that “AUSD is fully backed.” Agora’s statements indicate the token minted on Initia was a bridged representation rather than AUSD itself. D2 said the AUSD that left came from an Ethereum lockbox adapter backing that bridged token.

Onchain records show the 1.4 million AUSD sat in the attacker’s Ethereum address for about 84 seconds before it was traded away on the 1inch aggregator at 11:03 a.m. ET. Agora froze that address at 12:31 p.m. ET, roughly 89 minutes later and before its first statement, when the address held no AUSD.

The same address sent 1,135.5 ETH, which D2 valued at about $2.7 million, to a newly used wallet at 11:41 a.m. ET, the minute the halt took effect.

Initia’s own account has not confirmed Zon’s loss figure or published a post-mortem. It said it would post verified updates through its official channels.

Related Listen: Who’s to Blame for How KelpDAO’s DVN Was Set Up? KelpDAO or LayerZero?