Initia Says MoveVM Flaw Enabled About $2.7M in Transfers

Initia said an attacker used a MoveVM script-caching flaw on Oct. 23 to bypass checks and transfer about $2.7 million in assets before the network was paused.

The attack began at 10:59 a.m. ET (14:59 UTC), Initia said. The flaw let the attacker create false MoveVM state and receive unsupported balances in wrapped Ether (WETH), iUSD and USD Coin (USDC). The total supply of those tokens did not change, and no new INIT was minted.

Before the pause, about 105 WETH and 1.4 million AUSD0 moved through LayerZero, while roughly 1.08 million USDC moved through Noble and CCTP. Initia said the assets were later exchanged for 1,135.52 Ether (ETH), now held at an Ethereum address.

Initia expects to complete a security fix and audit within days. Its Layer 1 network and Rollup remain paused as recovery work continues with security partners. A full postmortem is planned.