Initia MoveVM exploit drains $2.7 million and halts its chain
An attacker used a flaw in Initia's MoveVM to credit itself with unbacked tokens and bridge out about $2.7 million, forcing the network and its rollups offline while a fix is audited.
The Initia MoveVM exploit has kept one of the newer Layer 1 blockchains offline since Friday. Initia halted its main chain and rollups on Friday, Oct. 23, after an attacker abused a flaw in its MoveVM implementation to create token balances out of thin air and move about $2.7 million of assets off the network, according to the project and The Block.
What happened
Co-founder Ezaan Mangalji, known as Zon, said early findings pointed to a previously unknown "Day 0" bug that allowed unauthorized minting but "does not apply to native INIT tokens." The attacker "was able to mint and bridge out ~$2.7m worth of AUSD, ETH, and USDC before the chain was paused," he said, The Block reported. Researcher Spreek had first put the haul at roughly $2.6 million and said more funds appeared to be in transit. On Friday, Initia said it was investigating with security teams, validators and exchanges and had not yet confirmed the amount lost.
In a follow-up on Saturday, Initia said the attack began at 10:59 a.m. ET and exploited a script-caching weakness that let the attacker forge MoveVM state, TokenPost reported. That produced unsupported balances in wrapped ether, iUSD and USDC without changing the total supply of those tokens.
About 105 WETH and 1.4 million AUSD0 left through LayerZero and roughly 1.08 million USDC through Noble and CCTP. The proceeds were then swapped into 1,135.52 ETH, which now sits at an Ethereum address, according to Initia's account. The flaw sat in Initia's implementation of the Move virtual machine on the Cosmos SDK, the software stack the project uses to link its main chain with application-specific rollups.
Why it matters
Markets shrugged. INIT fell 14% immediately after the incident was reported, then reversed to trade 14% higher on the day, The Block said. The sum is modest by crypto-hack standards, but the Initia MoveVM exploit is a reminder that new virtual machines carry new risks, especially where bridges let forged balances turn into real assets on other chains within minutes.
It also adds to a busy month for security teams. Losses from audited code and cross-chain bridges were already a theme in Hacken's third-quarter report, and the Qubic wallet drain showed how a single weakness can hit many users at once.
Halting a chain is a blunt tool. It stopped further outflows, but it also freezes every user and application on Initia's Layer 1 and rollups until validators restart the network.
What's next
Initia expects to finish and audit a fix within days and said recovery work is under way with security partners, exchanges and validators, according to TokenPost and The Crypto Basic. A full postmortem is planned. The project has not yet said whether it will try to claw back or compensate the bridged assets.
Investors will watch whether bridges and exchanges can freeze any of the stolen funds before they move, and how quickly the chain restarts. Initial details of the Initia MoveVM exploit are in The Block's report.
This article is for information only and is not investment advice.