Initia Exploit Drains $2.7M After MoveVM Bug Allows Unauthorized Token Minting

Initia is working to patch a critical vulnerability after an attacker exploited its MoveVM implementation to create unbacked assets and bridge roughly $2.7 million out of the network.

The modular blockchain halted both its Layer 1 and associated rollups on October 23 after detecting the security incident. Initia later said the attacker had abused a bug in MoveVM's script caching mechanism, allowing malicious code to bypass security checks and manipulate the state seen by the virtual machine.

The incident affected wrapped and bridged assets rather than Initia's native INIT token, according to the project.

Initia Halts L1 and Rollups After Security Incident

Initia stopped its Layer 1 and rollup networks at 15:41 UTC on October 23 while developers, validators, exchanges and security specialists investigated the incident.

Initial reports from blockchain researcher Spreek suggested that an attacker had found a way to mint assets without authorization and had already moved more than $2.6 million out of the ecosystem.

Initia subsequently provided more detail and confirmed approximately $2.7 million had been bridged out before the network was halted.

The decision to stop both the base network and its rollups prevented further exploitation while developers investigated the vulnerability.

Unlike an exploit confined to an individual decentralized application, the issue affected infrastructure at the virtual-machine level, making the potential impact considerably broader.

MoveVM Script Caching Bug Was the Root Cause

Initia's investigation identified the vulnerability in its implementation of MoveVM on Cosmos SDK.

According to the project's incident update, the attacker exploited a flaw in MoveVM script caching. The bug allowed malicious code to bypass checks that should have prevented unauthorized state manipulation.

The attacker was then able to spoof MoveVM state and credit themselves with assets that were not properly backed.

This is an important distinction from simply minting additional native INIT.

Initia said the exploit did not increase the supply of INIT and did not allow the attacker to mint native INIT tokens.

Instead, the manipulated state resulted in the attacker receiving unbacked representations of assets including WETH, iUSD-related assets and USDC.

The incident therefore exposed a vulnerability in how the execution environment handled state rather than a flaw in the monetary policy of INIT itself.

Attacker Bridges Roughly $2.7 Million Out

Before validators halted the network, the attacker was able to move approximately $2.7 million in assets away from Initia.

Initia said the outgoing funds included approximately 105 WETH, around 1.4 million AUSD0 and roughly 1.08 million USDC. The assets were moved through infrastructure including LayerZero, Noble and Circle's Cross-Chain Transfer Protocol.

The funds were subsequently converted into approximately 1,135.52 ETH and moved to an Ethereum address identified by the project.

The use of cross-chain infrastructure illustrates one of the challenges facing blockchain security teams after an exploit.

Once improperly created assets can be moved to another network and exchanged for liquid assets such as ETH, containment becomes considerably more difficult.

Stopping the compromised chain can prevent additional transactions locally, but it cannot automatically reverse assets that have already reached another blockchain.

Native INIT Supply Was Not Affected

One of Initia's key clarifications following the attack was that the native INIT token itself was not vulnerable to the minting method used by the attacker.

Early descriptions of the incident referred broadly to unauthorized token minting, leading to concerns that the exploit could have compromised INIT's supply.

The project later said that was not the case.

The vulnerability allowed the attacker to manipulate MoveVM state in a way that credited unbacked versions of other assets without modifying the corresponding legitimate token supplies. Native INIT was not minted as part of the attack.

This distinction matters because an exploit capable of arbitrarily increasing a blockchain's native token supply could create considerably wider economic consequences.

The approximately $2.7 million loss remains significant, but the incident did not compromise INIT's underlying issuance mechanism based on the information released so far.

Initia Prepares Security Patch

Initia has since drafted a fix for the vulnerability.

The project said the patch is being reviewed by security partners before the Layer 1 and rollups are restarted.

Rather than immediately bringing the network back online after identifying the root cause, Initia is keeping operations halted while the fix undergoes security auditing. The team has said it will provide a concrete restart plan once those audits are complete.

It is also working with security partners on recovery efforts involving the assets moved during the exploit.

A full post-mortem is expected after the investigation and remediation work are completed.

Why Virtual Machine Bugs Are Particularly Serious

Smart contract exploits usually involve an error inside an individual application.

A vulnerability in a blockchain's execution environment presents a different risk.

Virtual machines are responsible for executing the code used by applications on a blockchain. If assumptions inside that environment can be bypassed, multiple applications or assets may potentially inherit the same weakness.

In Initia's case, preliminary findings indicate that script caching allowed specially constructed code to avoid the expected security checks.

That turned an implementation detail in the execution layer into a mechanism capable of producing economically valuable, unbacked assets.

The incident demonstrates why blockchain security audits cannot stop at application-level smart contracts.

Virtual machines, bridges, cross-chain messaging systems, caching mechanisms and state-transition logic all form part of the security boundary.

Cross-Chain Infrastructure Can Amplify Exploits

The attack also highlights the role bridges can play during security incidents.

The attacker did not simply create unbacked assets and leave them inside Initia.

Those assets were rapidly transferred through cross-chain systems and converted into assets on Ethereum before the network could be stopped.

That sequence reduces the time available for validators and protocol developers to respond.

It also means that security monitoring increasingly needs to operate across several networks simultaneously.

An anomaly beginning on one blockchain may become an Ethereum, Solana or stablecoin issuer problem minutes later if the assets can move through interconnected bridge infrastructure.

Initia Incident Adds to 2026's Blockchain Security Risks

The Initia exploit is another reminder that increasingly interconnected blockchain architectures create new security assumptions alongside their benefits.

Rollups, bridges and modular execution environments allow applications to move assets and data efficiently across networks, but every additional layer introduces code and infrastructure that must behave correctly.

Initia's response limited the exploit by stopping the network, while the project says the vulnerability has now been identified and a patch is undergoing audit.

The next important milestones will be completion of the security review, restoration of the affected assets' backing and the orderly restart of Initia's Layer 1 and rollups.

Until then, the network remains a useful case study in how a low-level execution bug can quickly become a multi-million-dollar cross-chain security incident.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.