Initia MoveVM script-cache exploit hack — October 2026

Initia is a Cosmos SDK layer-1 blockchain that runs the Move virtual machine and hosts its own rollups. At 14:59 UTC on 23 October 2026, according to Initia, an attacker exploited a bug in MoveVM’s script caching that let malicious code bypass security checks and spoof the VM’s state, crediting the attacker with unbacked WETH, iUSD and USDC without changing those tokens’ total supply. No native INIT was minted. Initia halted the L1 and its rollups at 15:41:30 UTC.

Before the halt the attacker bridged out roughly $2.7 million, which Initia itemised as 105 WETH and about 1.4 million AUSD0 via LayerZero and about 1.08 million USDC via Noble and CCTP. Bitquery, which traced the run, counts $7.48 million printed at face value on Initia and $2.73 million paid out in real coins by three bridge reserves, the headline here; Noble’s USDC reserve fell from $1.09 million to $63 in 36 minutes. Everything that got out was swapped into 1,135.52 ETH in one Ethereum wallet, which began moving funds on 28 October.

Initia said a fix had been drafted and was under audit on 27 October, and on 28 October that, with the Initia Foundation’s help, the backing of affected assets would be fully restored when the chain resumes. That is compensation from the project, not a recovery from the attacker, so nothing is counted as recovered. Bithumb and Upbit flagged INIT as a caution asset. The chain is recorded as “other” because the registry has no Initia value.