Initia's bug minted 2,000,000 AUSD out of nothing. The bridge, being a polite bridge, believed it.
Per D2 Finance's decode: one tx at 14:59 UTC did the mint. 153 seconds later, a perfectly valid LayerZero message released 1.4M real AUSD from the Ethereum adapter. About $2.65M was back on Ethereum within 7 minutes 21 seconds.
Initia halted the L1 and rollups at 15:41 UTC. The exit took 7 minutes. The stop button took 42.
Co-founder zon calls it a Day 0 MoveVM bug that let the attacker mint extra tokens on the L1, and says native INIT isn't affected. Agora froze the linked AUSD account, which had already swapped into ETH.
Follow the Value: fake dollars on one chain became real ETH on another. By the decode, the bridge wasn't broken. It was persuaded.
"INIT unaffected" is true and also cold comfort. The token is fine. The chain it lives on is paused.
If your security model ends at "halt the chain," is that a feature or a confession?