Initia network halted after MoveVM vulnerability allowed attacker to spoof state and mint $2.7M in unbacked tokens.
Security & Exploits ·
Initia halted its network on October 23rd following an exploit of a vulnerability in MoveVM's script caching mechanism. An attacker leveraged the bug to spoof the MoveVM state and credit themselves with unbacked WETH, iUSD, and USDC tokens without modifying the corresponding total supplies. The attacker bridged approximately $2.7M in assets—105 WETH, roughly 1.4M AUSD0, and approximately 1.08M USDC—across LayerZero, Noble, and CCTP before the network halt, swapping the tokens for 1,135.52 ETH now held in a single Ethereum address. Native INIT tokens were not minted, and total INIT supply remained unaffected.
The incident triggered an immediate network halt affecting both Initia L1 and its rollups. The team indicated it is developing a security fix expected to be completed and audited within days, while asset recovery efforts are underway with security partners.
Full details of the vulnerability and a comprehensive post-mortem remain pending as the network remains offline.