Initia says MoveVM caching bug exploit drained about $2.7M

Layer-1 blockchain Initia said an attack exploiting a script-caching bug in Initia’s MoveVM occurred at around 2:59 p.m. UTC on Oct. 23, according to the project’s official X account.

The attacker bypassed security checks, forged the MoveVM state and allocated WETH, iUSD and USDC to the attacker’s own accounts without posting actual collateral, Initia said. It added that the total supply of those tokens did not change, no native INIT tokens were minted and INIT’s total supply was unaffected.

Before the network was halted, the attacker bridged out assets worth about $2.7 million, including 105 WETH and about 1.4 million AUSD0 through LayerZero and about 1.08 million USDC through Noble and CCTP, the post said. The stolen funds were then swapped into 1,135.52 ETH and are now being held at an Ethereum mainnet address beginning with 0x358.

Initia said the team is applying a security patch for the vulnerability and expects to complete the work and an audit within days. It added that recovery efforts are underway with security partners. Initia’s L1 and rollups remain offline, and the team plans to release a post-incident analysis report after the network safely resumes.