Worked example · 2026-10
Initia — a MoveVM script-caching bug let one transaction credit the attacker with unbacked tokens, and the bridges paid out real assets for them — Initia L1 / Ethereum — 2026-10-23
Summary
At 14:59 UTC on 2026-10-23 one signed transaction produced the unbacked balances; ~$2.65M was back on Ethereum within 7 m 21 s. Initia promised a patch, audit and post-mortem.
Timeline (UTC)
Read it as three stages. Get in: a MoveVM caching bug. Prepare: Tornado funding and test transfers. Take: unbacked balances created on Initia, then bridged out at par. Times are from D2 Finance's decoding unless marked.
| When | What happened | OAK |
|---|---|---|
| Before 2026-10-23 (undisclosed) | A bug in Initia MoveVM's script caching lets malicious code bypass security checks (Initia). Since when is not published. | T9.014 |
| 2026-10-23 08:27 | 0.0979 ETH from Tornado Cash's 0.1 ETH pool funds the attacker's preparation (traced by OAK). | T7.001 (funding) |
| 2026-10-23 from 13:14 | Dust sends through Axelar's AxelarHandler. |
— |
| 2026-10-23 14:37 | A 0.006 ETH deposit into the same ETH adapter the attacker empties 29 minutes later. | — |
| 2026-10-23 14:59:26 | One signed transaction, the attacker's own key calling one Move function (135,888 gas), credits unbacked WETH, iUSD and USDC and 2,000,000 AUSD (D2's figure) without changing token total supply (Initia). No INIT is minted. | T9.014 |
| 153 s later | A valid LayerZero message releases 1.4M real AUSD from the Ethereum adapter. LayerZero DVNs attest burns that really happened, and the adapter cannot tell whether burned tokens were backed. | T7.003 |
| within 7 m 21 s of the mint | Three exits into one Ethereum address: 1.4M AUSD (71% of the adapter's balance), 105 ETH from the native-ETH adapter (96%), and 1.08M USDC minted via Circle CCTP. About $2.65M is back on Ethereum. | T7.003 |
| within about 3 minutes of landing | Every stablecoin is swapped to ETH via 1inch and 0x (AUSD in 84 seconds). All 1,135.52 ETH (about $2.73M) ends in a fresh wallet. | — |
| 2026-10-23 15:41:30 | Initia halts the L1 and all rollups. The halt is announced at 16:00 UTC. | response |
| 2026-10-24 08:46 | Initia says funds sit unmoved in the wallet below, a patch and audit are expected in a few days, recovery is under way with security partners, and a full post-mortem will follow. Funds not moved as of this statement. | response |
| 2026-10-27 13:06 to 2026-10-28 15:46 | The holding wallet sends all 1,135.52 ETH on: 400 ETH to one split wallet and 735.52 ETH to another. 920 ETH goes into Tornado Cash through the router, and about 215 ETH is peeled into ten wallets and on to collectors (traced by OAK). | T7.001 |
Key addresses:
- Holding wallet for 1,135.52 ETH (Ethereum) —
0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. Traced by OAK: received the ETH on 2026-10-23 15:41:35 and sent all of it on from 2026-10-27 (see Fund flow). - Address receiving the three bridge exits —
0xdd922c841d85e12dac2dc2eef5a5e29cfff6edfa, the address D2 published only in shortened form. Traced by OAK; D2 shortens the holding wallet too, matching the entry above.
Fund flow
Ethereum leg traced by OAK with tools/explorer.py (Blockscout, keyless) on 2026-10-30, with a trace window of about five days after the exploit (to 2026-10-28, extended to 2026-10-29 for the last Tornado deposits). The Initia L1 and Noble legs are not supported by the tool, so those edges are relayed from the cited sources and drawn dashed. Counterfeit-token transfers were excluded: from minutes after the exploit, address-poisoning bots sent the exit address and the holding wallet fake "ETH" Transfer events from lookalike addresses with the same first four and last four characters (for example 0x358e8903fef95f152ad008528645759deaf5cac8, 0x3587a7e43037f3efc6b4183405f2a5a39941cac8, 0x358e99deaf8cc36cff2df3ce1635b5b84bd4cac8 and 0x358ec5bded6bf6b801ac466ed2cf27e283b0cac8 imitating the real holding wallet 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8). The tool reported more than 70 skipped unverified token transfers on the two wallets. The first-hop wallet 0x6b1175612794568d56d72afaa098402afc0299a4 was also imitated by many lookalikes sharing its first four and last four characters; only the real one received native ETH signed by the holding wallet.
All transfers as a table (41)
What the trace adds beyond the sources:
- The exit address is
0xdd922c841d85e12dac2dc2eef5a5e29cfff6edfa(D2 published it only shortened). It matches D2's decoding on every figure: the LayerZero AUSD release at 15:01:59 is 153 s after the 14:59:26 mint, the AUSD swap at 15:03:23 is 84 s later, and the last exit (105 ETH, 15:06:47) is exactly 7 m 21 s after the mint. - Preparation funding. The Tornado Cash withdrawal into it at 08:26:59 UTC was 0.0979495 ETH (the 0.1 ETH pool, net of a relayer fee), not a full 0.1 ETH. The 0.006 ETH "deposit into the ETH adapter" at 14:37:35 went to the WETH contract
0x66a503a1060ab3f2b1aaabed613fe30babbc1bde, the same contract that paid out the 105 ETH. - USDC came in two CCTP mints, not one: 999,999.892101 USDC at 15:02:35 and 79,999.847658 USDC at 15:25:11 (total 1,079,999.739759, the "1.08M"). The second was swapped at 15:26:47 for 33.18 ETH through the 0x Settler; the other swaps went through the 1inch v6 router. The three swaps returned 1,030.44 ETH, plus 105 ETH from WETH and the 0.0979 ETH Tornado funding, minus gas, gives the 1,135.52459058 ETH sent to the holding wallet at 15:41:35.
- The holding wallet did not stay put. Initia said on 2026-10-24 that funds sat unmoved; that was true then. From 2026-10-27 13:06 UTC the wallet sent out its whole balance as native ETH: 400 ETH to
0xa764b87fcb14bc850b68dfe41720cba3b24a89c0in two sends, and 735.52466511 ETH to0x6b1175612794568d56d72afaa098402afc0299a4in four sends on 2026-10-28 (the small difference from 1,135.52459058 is poisoning dust of 0.0001 ETH it received). - Tornado Cash again. 920 ETH went into Tornado Cash (100 ETH and 10 ETH pool deposits through the router) between 2026-10-28 10:08 and 15:13 UTC: 100 from the first split wallet, 100 from a gas-and-mixer wallet, and 720 (nine deposits) from the second. This is the same service that funded the preparation (T7.001).
- Peel chain. About 215 ETH was split into 10 fresh wallets in amounts of 0.4 to 59 ETH, each of which forwarded its whole balance to a collector wallet within about a minute. These collectors are not traced further here.
Limits:
- The Initia L1 and Noble legs are not supported by the tool; those edges are relayed from
[d2initia2026]and carry no tx. The Initia-side attacker address is not published. - The five collectors (the last five intermediary nodes before the Tornado node) were not followed.
0xf374966fe9bc01204a6e3c9c91a381c2942d407bfans out to many wallets and0xcebf738348372f6d918584090c0ae74fe4c8fca3forwards to a wallet labelled "Sweeper" by the explorer; both are outside the trace window. - Explorer labels are hints, not attribution.
Root-cause evidence
- Technique: OAK-T9.014
- Source: https://x.com/initia/status/2113915002008612945; https://x.com/D2_Finance/status/2113667420359700509
- Source type: operator
- Confidence: confirmed
- Evidence: Initia names the MoveVM script-caching bug; D2 Finance's decoding gives the transaction timing and bridge exits. D2 describes a 2,000,000 AUSD "mint", Initia says total supply did not change; both agree the balances were unbacked.
Public references
[initiastatement2026]— Initia on X (2026-10-24): https://x.com/initia/status/2113915002008612945[initiahalt2026]— Initia on X, halt (2026-10-23): https://x.com/initia/status/2113661738625155217[d2initia2026]— D2 Finance, exploit decoding: https://x.com/D2_Finance/status/2113667420359700509