Agora Freezes AUSD Account Linked to Initia Exploit

Agora’s $AUSD contract on Ethereum froze an address identified by onchain analyst Spreek as belonging to the Initia attacker on Oct. 23, while the issuer said it has no smart contracts on Initia itself.

A successful batchFreeze transaction at 12:31:59 p.m. ET emitted an `AccountFrozen` event for `0xDD922c841d85E12dac2dc2eef5a5E29cFFf6edFA`, the same address Spreek had identified.

The address had already swapped 1.4 million $AUSD for ETH through 1inch at 11:03:23 a.m. ET, more than an hour before the freeze. Its Ethereum $AUSD balance was zero when reviewed. The account freeze therefore should not be read as recovery of that 1.4 million $AUSD.

In its Oct. 23 statement, Agora said its security team was monitoring the incident and “will freeze funds related to hacker addresses that hold $AUSD on chains where $AUSD/Agora smart contracts are deployed.”

Limits for $AUSD Holders on Initia

The distinction matters because the reported exploit targeted bridge backing, not just tokens held in an attacker’s wallet.

Spreek said the attacker created bridgeable tokens without backing and sent them back through the bridge to drain its contract, without needing to sell them on Initia. He warned that this left $AUSD and similar bridged assets on Initia unbacked.

Under that reported mechanism, freezing an $AUSD account on Ethereum does not replace the bridge assets supporting tokens left on Initia. Agora’s statement also puts those Initia-side tokens outside the scope of its announced contract-level freeze response.

Agora’s technical documentation gives designated accounts a “Freezer” role that can freeze tokens. Its deployment list includes Ethereum, Arbitrum, Avalanche, Base, Immutable, Katana, Mantle, Monad, Polygon and Solana, but not Initia.

The response follows Initia’s halt of its Layer 1 and rollups. Initia dated the shutdown to 11:41:30 a.m. ET on Oct. 23 and said it was investigating the impact with security teams, validators and exchanges. Its statement did not confirm the reported minting mechanism or give a restart time.