Initia said an attacker exploited a script caching flaw in its MoveVM implementation at 22:59 UTC+8 on Oct. 23, bypassing security checks and forging MoveVM state to credit unsupported balances of WETH, iUSD and USDC. The project said total supply for the affected tokens did not change, and INIT was not minted, leaving its total supply unaffected.
Before the network was paused, the attacker moved about $2.7 million in assets, according to Initia. The transfers included 105 WETH and about 1.4 million AUSD0 sent out through LayerZero, as well as about 1.08 million USDC moved through Noble and CCTP. Initia said the funds were later swapped into 1,135.52 ETH, which are now held at Ethereum address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8.
The team said a security fix is expected to be completed within days and then audited. Recovery efforts are under way with security partners. Initia added that its L1 and Rollups remain paused, and that it plans to publish a full post-incident report later.
Initia said an attacker exploited a script caching flaw in Initia MoveVM at 22:59 UTC+8 on Oct. 23, bypassed security checks, forged MoveVM state, and credited unsupported balances of WETH, iUSD and USDC to the attacker.
The project said total supply for the affected tokens did not change. It also said INIT was not minted, and its total supply was not affected.
Assets moved before the halt
According to Initia, about $2.7 million in assets had already been moved out before the network was paused. That included 105 WETH and about 1.4 million AUSD0 transferred through LayerZero, along with about 1.08 million USDC transferred through Noble and CCTP. The funds were later swapped into 1,135.52 ETH.
Initia said the ETH is currently held at Ethereum address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8.
Next steps
The team said a security fix is expected to be completed within days and to pass an audit. It also said asset recovery work is under way with security partners. Initia's L1 and Rollups remain paused, and the project said it will release a full postmortem report later.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
