In Initia exploit, 1.4M AUSD stablecoin tokens went to an attacker

The Initia exploit affected a third-party product using Agora’s AUSD stablecoin on Ethereum, not new AUSD issuance on Initia, Agora said on October 23, 2026. Ethereum records show 1.4 million existing AUSD moved to an attacker’s address, while the issuer disputed claims that its tokens had been minted on Initia.

Key takeaways

• Agora says its AUSD contract does not exist on Initia.
• The attacker exchanged 1.4 million AUSD for approximately 581.56 ETH.
• Initia stopped its base blockchain and rollups during the investigation.

Agora disputes AUSD stablecoin minting in the Initia exploit

Agora said the affected product was not operated by Agora. Its response challenged D2 Finance’s description of an Initia-side transaction as minting “2,000,000 AUSD out of nothing” before an Ethereum adapter payout.

“The AUSD smart contract is not deployed on Initia and no AUSD was minted on Initia,” Agora wrote on X.

Security researcher Spreek separately estimated that an attacker had cashed out approximately $2.6 million, with additional funds still moving at the time of the post.

Ethereum records show existing tokens leaving an adapter

At 11:01 a.m. ET, an Ethereum transaction showed 1.4 million AUSD transferred from adapter address 0x38b8…C844 to 0xDD92…edFA, a movement that D2 Finance flagged in its breakdown of the attack.

The transaction included an OFTReceived bridge event and moved tokens already in existence; it was not a mint of new AUSD on Ethereum. Approximately 576,141 AUSD remained in the adapter when checked.

The recipient exchanged the stolen AUSD for about 581.56 ETH. According to Ethereum records, a subsequent transfer of 1,135.5 ETH was also tied to the event.

How AUSD reaches Initia through LayerZero

As Initia previously explained, its native iUSD wraps AUSD0, which represents AUSD that has been bridged over from Ethereum via LayerZero—a setup that sets Agora’s stablecoin apart from its other representations on Initia.

According to LayerZero’s documentation, standard OFT adapters simply custody existing tokens and forward them to recipients, leaving the original token contract unchanged. On Etherscan, the sending adapter’s implementation is listed as AUSDOFTAdapterUpgradeable.

Initia halts operations as Agora pledges freezes

Initia halted its Layer 1 and rollups at 3:41:30 p.m. UTC on October 23, equivalent to 11:41:30 a.m. ET. It said security teams, validators and exchanges were helping investigate the incident’s scope.

Agora pledged to freeze AUSD at hacker-related addresses on chains where its contracts operate. The recipient had already completed the AUSD-to-ETH swap before that pledge.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.