The hacker printed $7.48M on Initia. Bridge reserves paid out the real $2.73M
Initia halted on 23 October, 42 minutes after the printing began. We followed every coin that got out in that time and found who paid for it: the bridges that hold real coins for Initia's users.
- $7.48M
- $2.73M
- 99.99%
- 55
- 1,135.5 ETH
- 0
01 · What happenedSomeone printed money on Initia, then Initia stopped
On Friday afternoon, Initia stopped. Initia is a blockchain, a shared ledger that runs apps and coins. In the hour before it stopped, someone printed money on it. They turned part of it into real dollars and ether, about $2.73M worth.
The chain was built to link many smaller app chains, and at 15:41 UTC that day its team halted it, along with all of those smaller chains. In a post soon after, the team said it was looking into what happened, with help from exchanges and security teams.
An early public alarm came from Spreek, a security researcher, in a post at 15:27 UTC. It said someone was making tokens on Initia without limit and had already cashed out $2.6M.
Bitquery followed the money. We read Initia's own public record and traced each coin that left, across Ethereum and five other chains. One account did all the printing, in four batches over 13 seconds, and the real money it took out came from bridges, the services that move coins between chains. Each bridge holds a reserve of real coins for the people who use it, and the hacker drew down three of them, one almost to zero.
02 · How coins reach InitiaInitia's bridges, reserves and copies
Most of the dollars and ether on the chain started life elsewhere, and they reach it through bridges. A bridge cannot really move a coin. It locks the real coin in a reserve on its home chain and issues a copy on Initia. When someone sends the copy back, the bridge destroys it and the reserve pays out the real coin. So a copy is only worth what the reserve behind it can pay.
Three bridges matter here. Two run on LayerZero, a bridge service: one brings ether and one brings AUSD. AUSD is a dollar coin issued by Agora, and its copy on Initia is called AUSD0. USDC comes from Noble, a chain that issues Circle's USDC to Cosmos chains. Noble sends it on to Ethereum through CCTP, Circle's own transfer system. Initia also has its own dollar coin, iUSD, which is made one for one against AUSD0. Bitquery's cross-chain data follows coins through hops like these.
A bridge cannot tell a fake copy from a real one. Printing tokens with nothing behind them and cashing them in at a bridge is also how the SingularityNET hack drained Fetch.ai's bridge.
03 · The hacker's dayGas money, test runs, then four batches
The hacker got ready on Ethereum. That morning its wallet got 0.098 ETH from Tornado Cash, a mixer that hides where coins came from. That was enough to pay its fees. Early that afternoon it sent three tiny test runs toward Osmosis, another Cosmos chain. Then it sent a little ether to Initia over LayerZero.
Fees on Initia are paid in INIT, the chain's own coin. Then 141 INIT came in from a wallet on Osmosis, and the hacker had what it needed. It uploaded a small program of its own 16 minutes later. The first try failed. The second worked, and the account ran the program four times in 13 seconds.
04 · What was printed$7.48M in fake tokens, at face value
Each run of the program handed the account a fresh batch of brand-new tokens. It made four kinds: iUSD, plus copies of USDC, AUSD and ether. Counted at face value, the price each token is meant to be worth, the four batches came to $7.48M.
None of it was backed. Nothing had been locked in any reserve, and the chain's own counts of each coin left them out. Initia has not said how the program got past the chain's rules. Until it does, the record shows what the program did. It does not show how.
Face value makes the haul look bigger than it was. iUSD exists only on Initia, and just 1.69 million real iUSD were in use. The hacker's 3 million could never have sold for anything close to $1. The copies of USDC, AUSD and ether were different. Each could go back over its bridge and come out as the real coin.
05 · The run for the exits11 tries in 33 minutes
The first copies left for Ethereum about a minute after the last batch. Over the next half hour the account tried 11 times to send tokens off Initia. Four got through. The AUSD and ether copies went over LayerZero, and USDC went through Noble and Circle.
Three USDC sends bounced because Noble's reserve was too small to pay them. One AUSD send failed on Initia, and another was blocked on its way to Ethereum. Twice the hacker tried to swap fake iUSD for AUSD copies on the way out, and neither swap ran.
06 · Who paidThe Initia hack drained three bridge reserves
Every real coin the hacker cashed out came from a reserve. Noble's USDC reserve held $1.09M just before the hacker's first cash-out. A second later, in Noble's next block, it held $87,383.
The hacker asked for more three times, and each time Noble's own error message gave the same short reason: insufficient funds. In between, a smaller $80k withdrawal got through at 15:24.
Other people paid next. Then 11 normal USDC withdrawals got out and took most of what was left, and by 15:37 the reserve held $63. From 15:28 UTC, others started to bounce, and 55 had failed by the halt. Most came from one trading bot that kept resending the same balance, never more than $21k, each time it came back. Initia's own count of USDC copies reads about 1.08 million, and when we checked, the reserve behind them held $24k.
The two bridge reserves on Ethereum lost less, though not by much. The ether reserve lost 96% of its coins, and the AUSD reserve lost 71%. That AUSD sits in a bridge contract, and Agora, which issues AUSD, says its coin does not exist on Initia and is fully backed.
07 · On EthereumSwapped to ETH, then parked in one wallet
On Ethereum, the hacker swapped each batch of AUSD and USDC for ether within three minutes of it landing. Most went through 1inch, a DEX aggregator that hunts for the best price across trading apps. It got about $2,407 per ETH.
Then, five seconds after the halt, it moved all 1,135.5 ETH to a fresh wallet, and when we checked three hours later, that wallet had never sent a single transfer. Bitquery's Ethereum API shows every step, and the full history is sold as files as the Ethereum dataset.
Agora said later that day that it would freeze AUSD held by the hacker's addresses. By then the hacker held none. It had swapped all of its AUSD for ether within two minutes of it arriving. Spreek's $2.6M was an early count. By the time of that post, the hacker's wallet already held about $2.73M in ether.
Within minutes of the move, scammers joined in. Fake ETH tokens made it look as if the old wallet had sent its 1,135.5 ETH to addresses that only resemble the new one, and look-alike wallets sent it tiny amounts of real ETH. That is address poisoning, a scam that hopes someone will copy the wrong address from a list of past transfers. The record does not tie those senders to the hacker.
08 · What did not get out$4.55M still on Initia, at face value
When the chain stopped, the hacker still held $4.55M in fake tokens, and most of that was the iUSD that had no way out. The rest is copies of USDC, AUSD and ether worth $1.55M. There is USDC that Noble could no longer pay, AUSD copies from the send that failed, and ether copies it never tried to move. The last 200,000 in AUSD copies never arrived. Four of the five checkers that must approve each of these LayerZero messages signed off, but LayerZero Labs' own did not, and at 17:51 UTC the AUSD bridge on Ethereum blocked the message.
09 · Other chainsNone of it reached Base, Arbitrum or BNB Chain
A hack on a chain built to link other chains raises an obvious question. Did the money spread? From the day before the attack, LayerZero sent 13,312 messages, its word for transfers between chains, to Base, Arbitrum, BNB Chain, Optimism and Polygon. Not one came from Initia.
We also checked USDC moving from Noble through Circle's system to Ethereum, Base and Arbitrum, and after the attack began, the hacker's two transfers were the only large ones on Ethereum. On Arbitrum one $17,984 transfer did come from Initia. It was sent by a long-running trading account, and no transfer we found ties it to the hacker.
10 · What it meansWhat the Initia hack means for users
For people with coins on Initia, the bridges now matter more than the hack itself. A USDC copy there is worth what Noble's reserve can pay. That reserve is close to empty. The reserve behind the ether copies is down 96%. How Initia and the bridges handle those gaps will decide what such balances are worth.
The attack also showed how the bridges behaved under stress, and Noble's reserve stopped the USDC only because it could not cover the amounts asked. LayerZero carried the first AUSD and the ether across in about a minute each. The last AUSD message never cleared, and the bridge on Ethereum blocked it later that day. LayerZero was also at the center of the Kelp DAO hack earlier this year.
Initia has asked users to be wary of links and messages that do not come from its team, and to wait for its updates. Do not pay anyone who offers to get coins back.
11 · How we traced itMethod and limits
Bitquery does not index Initia yet, so we read the chain's own public record. That covers every transfer from before the hacker's first move on Initia to the halt, and all the hacker's past ones. We matched each send against Noble's record and LayerZero's message tracker. We then followed the Ethereum side, and the five other chains, with Bitquery's data and address labels. Dollar coins count at $1 and ether at the price the hacker got.
Any Ethereum wallet here can be followed with the Bitquery MCP, which lets you ask an AI assistant where a wallet's money went. We traced other recent thefts the same way, including the Arkadiko hack, the CoinDCX hack and the NEAR Intents hack. Our Tornado Cash audit looks at who uses the mixer.
Bitquery does not index Initia yet. Initia's side comes from its public record: every transaction from 14:27 UTC until the halt at 15:41:30, and the hacker's full history.
Face values count iUSD, AUSD0 and USDC copies at $1 and WETH at the hacker's ETH price, $2,407. The fake iUSD could never have sold near $1.
We found one account creating tokens from nothing. A creation dressed up as a normal bridge delivery would pass the filter we used.
The wallet on Osmosis that paid the hacker's fees is linked only because the hacker later listed it as its refund address. We could not tie it to the hacker's key.
Initia has not explained the flaw. The record shows what the hacker's program did, not how it got past the chain's rules.
Balances were read at 18:52 UTC on 23 October.
12 · The addressesWhere to look
These are the main wallets, reserves and transfers in this story.
Follow the Initia money in plain English
The Ethereum side of this story comes from Bitquery's data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Ethereum dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell, hold or withdraw any token or asset, or to use or avoid any protocol, exchange, bridge or service.
The findings describe transactions and balances observed on Initia, Noble, Ethereum, Base, Arbitrum, BNB Chain, Optimism and Polygon on 22 and 23 October 2026. Attributions come from Bitquery's address labels and from on-chain behavior; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Initia, Noble, Circle, LayerZero, Agora, 1inch, Tornado Cash, Osmosis, Axelar or any other named project, company, service or person describe what the public record shows about addresses and transactions linked to them, and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The account that created the tokens is described by its behavior and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Initia hacked?
Yes. On 23 October one account created $7.48M of tokens out of nothing, at face value, and sent copies of USDC, AUSD and ether back over the bridges for real coins. Initia halted its chain at 15:41 UTC and has not yet said how the flaw worked.
How much was stolen in the Initia hack?
About $2.73M in real coins reached Ethereum, as AUSD, USDC and ether that the hacker swapped into 1,135.5 ETH. The rest of the $7.48M stayed behind or was blocked. Most of that was fake iUSD, which could never have sold near face value.
Who lost money in the Initia hack?
The real coins came out of bridge reserves held for the chain's users. Noble's reserve lost 99.99% at its low point, the ether reserve 96% and the AUSD reserve 71%. Normal USDC withdrawals began failing afterward.
Where did the stolen money go?
Everything that got out was swapped to ether on Ethereum and moved to one new wallet at 15:41:35 UTC. When we checked at 18:52 UTC, that wallet had not moved it.
Did the Initia hack reach other chains?
No. LayerZero carried nothing from Initia on Base, Arbitrum, BNB Chain, Optimism or Polygon since 22 October, and the hacker's USDC went only to Ethereum.