Initia: MoveVM Vulnerability Leads to ~$2.7 Million in Stolen Assets; Patch and Asset Recovery Efforts Underway

On October 24, official Initia announced on the X platform that at 22:59 Beijing Time on October 23, an attacker exploited a vulnerability in the Initia MoveVM script cache mechanism to bypass security checks. By forging virtual machine states, the attacker generated unsupported WETH, iUSD, and USDC for their own account without altering the total token supply. The attack did not mint additional native INIT tokens, leaving the total INIT supply unaffected.

Before the network pause, the attacker transferred approximately $2.7 million in assets through cross-chain channels such as LayerZero, Noble, and CCTP, including 105 WETH, approximately 1.4 million AUSD0, and 1.08 million USDC. These assets were subsequently swapped for 1,135.52 ETH and are currently held at the Ethereum mainnet address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8.

Initia stated that the team is patching the vulnerability, with fixes and security audits expected to be completed within the next few days. They are also collaborating with security partners to recover the assets. Currently, both the Initia L1 and Rollups networks remain suspended, and a specific resumption timeline has not been announced.