Initia Halts Chain After $2.7M MoveVM Exploit, No Restart Date Yet

Initia's Layer 1 chain and its rollups have been halted since 3:41:30 p.m. UTC on October 23, after an attacker minted unbacked stablecoins and moved about $2.7 million off the network. Initia said it was working with security teams, validators and exchanges to establish the full scope of the damage.

For INIT holders, the most important detail is about supply. Initia said no native INIT was minted and the total INIT supply is unaffected. The fake tokens were AUSD on Initia, not INIT. The cost to holders today is access: nothing moves on the L1 or the rollups until the chain restarts, and Initia has not given a date for that.

A 42-Minute Window Between Mint and Halt

Initia's October 24 update said the attacker exploited a script-caching bug in MoveVM, the engine that runs Move smart contracts on the chain, at 14:59 UTC on October 23. Initia said the malicious code bypassed security checks and spoofed the MoveVM state.

The attack began at 14:59:26 UTC with one signed transaction that minted 2 million AUSD on Initia. That transaction called a Move function directly, without the bridge message that would normally back new tokens arriving on the chain.

It worked fast. About seven minutes after the mint, roughly $2.65 million had already reached Ethereum. Initia said the bridge-outs were complete before the halt, which came about 42 minutes after that first mint.

Where the $2.7 Million Went

Initia put the outbound total at roughly $2.7 million, split across two routes:

• 105 WETH and about 1.4 million AUSD0 through LayerZero
• about 1.08 million USDC through Noble and Circle's Cross-Chain Transfer Protocol (CCTP)

On Ethereum, the funds were swapped through 1inch and 0x and consolidated into 1,135.52 ETH, worth about $2.73 million at the time. Initia named the receiving address as 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. We have not checked that balance on a block explorer.

The figures differ slightly by source. Researcher Spreek, who posted that the chain had been hacked and "a bunch of tokens infiniminted," estimated the cash-out at $2.6 million "with more in flight." Initia's own total is about $2.7 million. None of these numbers has been independently checked on-chain.

Agora said the incident involved a third-party product using AUSD and that it has no smart contracts deployed on Initia.

Restart Depends on a Fix Still Being Audited

Initia's first statement on October 23 gave no loss amount, no vulnerability and no restart schedule. The October 24 update filled in the first two but not the third.

Initia said a security fix is in progress and is expected to be completed and audited "in a few days." It said asset recovery is ongoing with security partners, and that the L1 and rollups remain halted while that work continues. The resume time was left for a later update.

Several questions are still open:

• whether any of the stolen funds have been recovered or frozen
• whether users or protocols will be compensated
• which applications on Initia were affected, and what individual users lost

The market reaction so far has been mild. On October 24, INIT traded at $0.1484, up 11.7% over 24 hours. That snapshot is two days old and may not reflect where the token trades now.

The shape of this attack, unbacked tokens minted on one chain and pushed out through bridges before anyone could stop them, is familiar from the suspected bridge exploit on Base that sent Autheo's THEO down 92%. The next thing to watch on Initia is the audited fix, and whether the restart notice says anything about the 1,135.52 ETH.