Initia said its L1 mainnet and rollups were halted at 15:41:30 UTC on Oct 23 because of a security incident, and that it is working with security teams, validators and exchanges. Co-founder Ezaan Mangalji said preliminary findings point to a previously unknown bug in Initia's MoveVM implementation on Cosmos SDK that allowed unauthorized minting, that native INIT tokens are not affected, and that the attacker minted and bridged out about $2.7M in AUSD, ETH and USDC before the pause. Initia has not confirmed the final loss.

If you hold assets on Initia rollups, follow only Initia's official channels; the team has warned against unverified links circulating during the outage.

Update Oct 24 (Initia): the exploit began at 14:59 UTC on Oct 23. A bug in MoveVM's script caching let malicious code bypass security checks and spoof VM state, crediting unbacked WETH, iUSD and USDC without changing total supply. No INIT was minted. Before the halt the attacker bridged out about $2.7M: 105 WETH and about 1.4M AUSD0 via LayerZero, and about 1.08M USDC via Noble/CCTP. That was swapped into 1,135.52 ETH, now held at 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. Initia expects an audited fix 'in a few days', is pursuing asset recovery, and says the chain stays halted until then.