# Initia L1 and rollups halted after MoveVM exploit drained about 2.7M to Ethereum

Source: https://x.com/initia/status/2113915002008612945
Kiwi News: https://news.kiwistand.com/stories/Initia-L1-and-rollups-halted-after-MoveVM-exploit-drained-about-27M-to-Ethereum?index=0x6addf5c0618d2e1905d8eb6b0c07fce6b9ac90fdc1a97bd88a36354734c1d876d1dc1622
Submitted by 0xbBfd...e91B on 2026-10-25 UTC, 1 upvote, 0 comments

## Summary

Initia L1 and its rollups were halted after an attacker exploited a bug in Initia MoveVM's script caching to credit themselves with unbacked WETH, iUSD, and USDC without changing those tokens' total supply. Before the halt, the attacker bridged out roughly $2.7M, including 105 WETH and about 1.4M AUSD0 via LayerZero and about 1.08M USDC via Noble and CCTP. The tokens were swapped for 1,135.52 ETH, which currently sits at an address on Ethereum Mainnet. Initia says a security fix is expected to be completed and audited within a few days, asset recovery is ongoing with security partners, and a full post-mortem will follow.

## Article

At 14:59 UTC on October 23rd, an attacker exploited a bug in Initia MoveVM’s script caching that allowed malicious code to bypass security checks. The attacker artificially spoofed the MoveVM state, thereby crediting themselves with unbacked WETH, iUSD, and USDC tokens without changing the corresponding token’s total supply. No native INIT was minted, and the total INIT supply is unaffected.

Before the network was halted, the attacker bridged out roughly $2.7M, comprising of 105 WETH and ~1.4M AUSD0 via LayerZero along with ~1.08M USDC via Noble and CCTP. The tokens were swapped for 1,135.52 ETH and currently sit in 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8 on Ethereum Mainnet.

We are actively working on a security fix to patch the identified vulnerability. We expect this to be completed and audited in a few days. Additionally, asset recovery efforts are ongoing with the help of security partners.

The Initia L1 and Rollups remain halted as we work toward a resolution. We hope to safely resume network operations as soon as possible and will provide a full post-mortem once available. In the meantime, we will continue to share verified updates through our official channels.

Please remain cautious of unofficial links, messages, or claims.