Initia Discloses Attack Details: MoveVM Cache Vulnerability Led to About $2.7 Million Transferred Out

October 24: Initia posted on X that at 22:59 (UTC+8) on October 23, an attacker exploited an Initia MoveVM script caching vulnerability to bypass security checks and forge MoveVM state, crediting itself with WETH, iUSD and USDC that had no actual backing; the total supply of the relevant tokens did not change, INIT was not minted, and its total supply was unaffected.

Before the network was paused, the attacker had already transferred out about $2.7 million in assets, including 105 WETH and about 1.4 million AUSD0 moved out via LayerZero, as well as about 1.08 million USDC moved out via Noble and CCTP. These were subsequently swapped for 1,135.52 ETH, which is currently held in the Ethereum address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8.

Initia said the security fix is expected to be completed within a few days and to pass an audit. Asset recovery efforts are being advanced together with security partners, the L1 and Rollups remain paused, and a full post-mortem report will be published later.