Initia halted its Layer 1 and rollups after an attacker exploited a MoveVM bug to create unbacked assets and bridge roughly $2.7 million out of the network. The project says native INIT was not minted, and a patch is now under security review.
Initia is working to patch a critical vulnerability after an attacker exploited its MoveVM implementation to create unbacked assets and bridge roughly $2.7 million out of the network. The project halted both its Layer 1 and associated rollups on October 23 after detecting the incident.
A script caching bug let malicious code skip checks
Initia said the attacker abused a bug in MoveVM's script caching mechanism, which allowed malicious code to bypass security checks and manipulate the state the virtual machine saw. The attacker then spoofed MoveVM state and credited themselves with assets that were not properly backed.
The manipulated state produced unbacked representations of WETH, iUSD-related assets and USDC. Initia said the exploit did not increase the supply of INIT and did not let the attacker mint native INIT.
Funds moved out through cross-chain infrastructure
Initia stopped its networks at 15:41 UTC on October 23. Blockchain researcher Spreek had initially reported that the attacker had moved more than $2.6 million out of the ecosystem, but Initia later confirmed approximately $2.7 million had been bridged out.
The outgoing funds included approximately 105 WETH, around 1.4 million AUSD0 and roughly 1.08 million USDC. The assets moved through LayerZero, Noble and Circle's Cross-Chain Transfer Protocol, according to the project. They were then converted into approximately 1,135.52 ETH and sent to an Ethereum address the project identified.
Stopping the chain can prevent further transactions locally, but it cannot automatically reverse assets that have already reached another blockchain, the article notes. Because the incident hit the virtual-machine level, rather than a single application, its potential impact was broader.
Patch awaits audit before restart
Initia has drafted a fix that security partners are reviewing before the Layer 1 and rollups restart. The team said it will provide a concrete restart plan once those audits are complete. It is also working with security partners on recovery efforts for the assets moved during the exploit.
A full post-mortem is expected after the investigation and remediation work finish.
Source: Crypto Daily™
Trading involves risk.
Risk Disclaimer
