The attacker needed about seven minutes. Initia needed about 42 to stop the chain. That gap, not the size of the loss, is the part of Friday’s Initia exploit worth studying.
Initia, a layer-1 blockchain built to link many rollups, halted its main chain and its rollups at 15:41:30 UTC on 23 October after what co-founder Zon called “a Day 0 bug related to Initia’s MoveVM on CosmosSDK”. He said the attacker was able to “mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused”, and that the bug “does not apply to native INIT tokens”. As of Saturday morning India time, Initia had published no post-mortem and no restart date.
The timeline, in IST
We converted the timestamps reported by Unchained and the 0xCERT advisory, which draw on D2 Finance’s on-chain breakdown, into Indian time.
| Time (IST, 23 Oct) | What happened |
|---|---|
| 8:29 PM | One transaction mints 2 million units of Initia’s bridged AUSD with no backing |
| 8:33 PM | The 1.4 million AUSD that landed on Ethereum is swapped away on 1inch, about 84 seconds after arriving |
| 8:36 PM | About $2.65 million is already on Ethereum, 7 minutes 21 seconds after the mint |
| 8:57 PM | Researcher Spreek publicly flags the attack |
| 9:11 PM | Initia halts the L1 and rollups; the attacker moves 1,135.5 ETH to a fresh wallet the same minute |
| 10:01 PM | Agora, AUSD’s issuer, freezes the attacker’s address, which by then holds no AUSD |
The money was gone roughly 35 minutes before the halt, and the freeze came about 89 minutes after the AUSD left. Speed of response mattered less than speed of exit.
Why the bridge paid out
Initia’s AUSD, ETH and USDC were bridged copies. The real tokens sat in “lockbox” contracts on Ethereum, which release funds when a valid message says matching tokens were burned on the other side. As D2 Finance put it, “an OFT adapter cannot check whether burned tokens were ever backed.”
So once the bug let the attacker create tokens out of nothing on Initia, burning them produced perfectly valid bridge messages. LayerZero’s adapters released about 1.4 million AUSD and 105 ETH, and about 1.08 million USDC was newly minted on Ethereum through Circle’s CCTP, according to Cointelegraph.
Our own sum of what the lockboxes lost, using D2’s figures:
| Pool on Ethereum | Taken | Left | Share drained |
|---|---|---|---|
| AUSD adapter | ~1.4M AUSD | ~576,000 AUSD | ~71% |
| Native-ETH adapter | 105 ETH | small remainder | ~96% |
Agora said no Agora-issued AUSD was minted on Initia and that AUSD is fully backed. The loss, per 0xCERT’s reading of D2’s corrected analysis, sits with depositors in the third-party AUSD adapter, not with AUSD holders generally.
The market shrugged, which is the odd part
The Block reported that INIT fell 14% on the news and then reversed to trade about 14% higher on the day. CoinGecko showed INIT at about $0.137 (₹13.02) on Saturday morning. A token can be untouched by a bug and still sit on a chain that can’t process transactions, so a bounce while the network is offline tells you about traders, not about the fix.
What it means for Indian investors
The haul of about $2.7 million is roughly ₹25.6 crore at about ₹94.9 per dollar (CoinGecko USDT/INR, 24 October). If you held bridged assets on Initia through any app, they are stuck until the chain restarts, and 0xCERT advises not bridging to or from Initia until the team confirms a fix.
The tax side is harsh. Under India’s 30% VDA regime (plus cess, and 1% TDS on transfers), losses can’t be set off against other income or carried forward, so a hack loss doesn’t reduce your tax bill elsewhere. Our crypto loss set-off calculator shows how much that rule costs next to share-market treatment, and more tools are on /tools/. For the asset the attacker ended up holding, see the Ethereum price page.
BtcMedia verdict
This was a minting bug, but the damage came from a bridge design that trusts the source chain completely. Halting a chain after funds have crossed only protects what’s left. Until bridges can rate-limit or check backing, the safest bridged asset is the one you don’t leave sitting on a young chain.
FAQ
Was INIT itself stolen? Initia’s co-founder said the bug does not apply to native INIT tokens. The minted tokens were bridged AUSD, ETH and USDC.
When will Initia restart? No date had been announced as of 24 October, and no post-mortem had been published.
Can Indians claim a hack loss against other crypto or share gains? No. Under the VDA rules, crypto losses can’t be set off against other income, including from a hack.
This article is for information only and is not financial advice.