Initia 🪢 · 2026-10-24 08:46 UTC

At 14:59 UTC on October 23rd, an attacker exploited a bug in Initia MoveVM’s script caching that allowed malicious code to bypass security checks. The attacker artificially spoofed the MoveVM state, thereby crediting themselves with unbacked WETH, iUSD, and USDC tokens without changing the corresponding token’s total supply. No native INIT was minted, and the total INIT supply is unaffected. Before the network was halted, the attacker bridged out roughly $2.7M, comprising of 105 WETH and ~1.4M AUSD0 via LayerZero along with ~1.08M USDC via Noble and CCTP. The tokens were swapped for 1,135.52 ETH and currently sit in 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8 on Ethereum Mainnet. We are actively working on a security fix to patch the identified vulnerability. We expect this to be completed and audited in a few days. Additionally, asset recovery efforts are ongoing with the help of security partners. The Initia L1 and Rollups remain halted as we work toward a resolution. We hope to safely resume network operations as soon as possible and will provide a full post-mortem once available. In the meantime, we will continue to share verified updates through our official channels. Please remain cautious of unofficial links, messages, or claims.

Loading the story on Tree News…