Initia's unauthorized mint, implanted Ledger devices and Abracadabra's emptied peg fund top the security docket

Recent entries on rekt.news cover three failures, and none of them came from a standard smart-contract coding error.

Initia, about $2.7 million, own layer-1 and rollups. On October 23, Initia halted its chain and rollups after an attacker minted tokens without authorization and converted them into other assets. The root cause is a logic bug in the chain's own code. Initia blamed a flaw in the script caching of its MoveVM implementation, which runs on the Cosmos software development kit (SDK). AMBCrypto reports that the attacker created 2 million AUSD tokens with a single signed transaction, which let the attacker skip bridge verification entirely, and then bridged the proceeds to Ethereum. Initia says the native INIT supply was not affected. Agora, the issuer of AUSD, said its canonical token is fully backed and that it has no contracts on Initia. A patch is under audit. No post-mortem or recovery has been published.

Ledger devices from a reseller, an estimated $102 million. This was a supply-chain hardware attack. Ledger's Donjon security team confirmed an implant in units sold by CryptoBilis, a Southeast Asian reseller. The implant reads the 24-word recovery phrase off the screen during setup and sends it out over a cellular connection. It does not affect the device's secure chip or operating system. Rekt.news puts the losses at about $102 million. Ledger calls the number of affected devices "limited" and has not confirmed a total. The European retailer MediaMarkt Saturn stopped selling Ledger devices on October 13 after a customer in Germany reported a tampered unit. Ledger has not confirmed that any units sold by MediaMarkt were affected.

Abracadabra, governance treasury. Rekt.news reports that the SPELL peg fund was emptied, a further 8 billion SPELL tokens were minted, and treasury assets moved toward exchanges, while the accounting that would explain these moves is still missing. The protocol was already winding down after about $21 million in bad debt, with an estimated payout of about four cents per MIM stablecoin. The sources reviewed carry no public accounting from Abracadabra.

CryptoSlate notes, using Keplr as its example, that restoring a hacked wallet from backup does not remove the thief's copy of the key. Funds have to move to a newly generated key. The DeFiHackLabs feed carried only documentation edits to its reproduction of a historical Opyn exploit (1, 2) and logged no new incident.