Posts
avatar

We decoded the @initia exploit. One signed tx at 14:59:26 UTC minted 2,000,000 AUSD out of nothing. 153 seconds later a valid @LayerZero_Core message released 1.4M real AUSD from the Ethereum adapter. $2.65M was back on Ethereum within 7m21s of the mint. Three exits, all into 0xDD92…edFA: AUSD: 1.4M from the AUSD OFT adapter, 71% of its balance, 576K left. ETH: 105 from the native-ETH OFT adapter, 96% of its balance, 4.84 left. USDC: 1.08M as fresh mints from 0x0, via Circle's CCTP. The mint was the attacker's own key calling one Move function, 135,888 gas, no bridge message involved. The token is an argument (recipient, token, amount), consistent with one wallet printing AUSD, USDC and ETH. LayerZero's DVNs then attested to burns that really happened, and an OFT adapter cannot check whether burned tokens were ever backed: each Ethereum lockbox pays at par for any Initia-side mint bug. Prep started 6.5 hours before the mint: 0.1 ETH from Tornado at 08:27 UTC, dust sends through @axelar AxelarHandler from 13:14, and a 0.006 ETH deposit at 14:37 into the same ETH adapter it emptied 29 minutes later. Every stable was ETH within 3 minutes of landing via 1inch and 0x, AUSD in 84 seconds. All 1,135.52 ETH (~$2.73M) now sits in a fresh wallet, 0x358e…CAC8. Same shape as Liquid on 6 Sep, where an Elements bug created 4,000 L-BTC and a valid peg-out paid 3,996 real BTC. Initia's DEX holds $3.50M of TVL and did $334K of volume in 24h. Its bridges carried 8x that for one wallet in 7m21s: on Initia, the deepest pool was the bridge.

This content is for informational and educational purposes only. It may include third-party insights, sponsored content, or promotional material for which the creator may receive compensation. Nothing in this feed constitutes investment advice or a guarantee of returns. You are solely responsible for your own investment decisions. Always conduct your own research and exercise caution before trading. We do not guarantee the accuracy of third-party information and are not liable for any losses incurred. Past performance is not indicative of future results. Please refer to our Community Terms and Risk Disclosure Statement for details.

avatarPost your reply

Comment