Initia discloses details of MoveVM vulnerability attack: approximately $2.7 million lost, INIT supply unaffected.

October 24: Initia posted a disclosure that at 22:59 Beijing time on October 23, an attacker exploited a MoveVM script caching vulnerability to bypass security checks, and by forging state, added unsupported WETH, iUSD, and USDC balances to itself without changing the total supply of the relevant tokens. Native INIT was not minted, and the total supply was unaffected.

Before the network halt, the attacker transferred out 105 WETH and approximately 1.4 million AUSD0 via LayerZero, and approximately $1.08 million USDC via Noble and CCTP, with a total asset value of approximately $2.7 million. These assets have been swapped for 1,135.52 ETH.

Initia L1 and Rollups remain suspended. The team is fixing the vulnerability, with the fix and audit expected to be completed within a few days, and is working with security partners to advance asset recovery. The official statement said a full incident analysis report will be released later, and reminded users to be wary of unofficial links, messages, and statements.