---
title: Initia halts its L1 and rollups after a MoveVM bug let an attacker mint unbacked tokens and bridge out about $2.7M | ctxsec
url: https://ctxsec.com/items/initia-l1-halt-movevm-mint-exploit-2-7m
description: ""
status: "confirmed (Initia official updates on X, Oct 23-24); full post-mortem pending"
published: 2026-10-23
---

> 

[← Cybersecurity News](/news) · [markdown](/items/initia-l1-halt-movevm-mint-exploit-2-7m.md)

confirmed (Initia official updates on X, Oct 23-24); full post-mortem pending

2026-10-23

### Initia halts its L1 and rollups after a MoveVM bug let an attacker mint unbacked tokens and bridge out about $2.7M

Initia said its L1 mainnet and rollups were halted at **15:41:30 UTC on Oct 23** because of a security incident, and that it is working with security teams, validators and exchanges. Co-founder Ezaan Mangalji said preliminary findings point to a previously unknown bug in Initia's MoveVM implementation on Cosmos SDK that allowed unauthorized minting, that native INIT tokens are not affected, and that the attacker minted and bridged out about **$2.7M** in AUSD, ETH and USDC before the pause. Initia has not confirmed the final loss.

If you hold assets on Initia rollups, follow only Initia's official channels; the team has warned against unverified links circulating during the outage.

**Update Oct 24 (Initia):** the exploit began at **14:59 UTC on Oct 23**. A bug in MoveVM's **script caching** let malicious code bypass security checks and spoof VM state, crediting unbacked WETH, iUSD and USDC **without changing total supply**. No INIT was minted. Before the halt the attacker bridged out about **$2.7M**: 105 WETH and about 1.4M AUSD0 via LayerZero, and about 1.08M USDC via Noble/CCTP. That was swapped into **1,135.52 ETH**, now held at `0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8`. Initia expects an audited fix 'in a few days', is pursuing asset recovery, and says the chain stays halted until then.

Sources: [Initia on X: incident update (Oct 24)](https://x.com/initia/status/2113915002008612945) · [Initia on X (Oct 23)](https://x.com/initia/status/2113661738625155217) · [The Block (Oct 23)](https://www.theblock.co/news/defi/2026-10-23-initia-halts-network-after-security-incident-attacker-reportedly-mints-tokens-427755) · [Cointelegraph (Oct 23)](https://cointelegraph.com/news/initia-halts-blockchain-exploit-drained)