Initia Halts Network as MoveVM Bug Enables $2.7M Cross-Chain Exploit

Layer-1 blockchain Initia and its rollups remain offline following a security incident on Oct. 23 that permitted an attacker to illicitly mint and bridge out approximately $2.7 million in assets ¹. The network was paused at 11:41 a.m. ET after suspicious activity surfaced, with the core team coordinating with validators, exchanges, and security teams to evaluate the breach ¹. As of Oct. 24, the network has set no official restart date ¹.

According to preliminary findings disclosed by Initia co-founder Zon, the breach stemmed from a zero-day vulnerability in Initia's MoveVM implementation on the Cosmos SDK ¹. The vulnerability permitted the attacker to mint auxiliary tokens directly on the Initia Layer 1, though Zon noted the bug did not impact native $INIT tokens ¹. Pseudonymous security researcher Spreek first detected the exploit at 11:27 a.m. ET, shortly before Initia halted Layer 1 and rollups ¹.

Bridge Drain and Liquidation

An analysis by D2 Finance revealed that the attacker initiated the exploit at 10:59 a.m. ET by minting 2 million unbacked units of a bridged representation of Agora's $AUSD on Initia ¹. The attacker then burned the unbacked tokens to trigger withdrawals via LayerZero to Ethereum ¹. Because LayerZero OFT lockbox adapters cannot verify whether burned tokens were originally backed, the Ethereum adapter unlocked genuine collateral ¹.

In total, the exploiter drained 1.4 million AUSD—comprising 71% of that adapter's balance—alongside 105 $ETH and 1.08 million $USDC bridged via Circle's Cross-Chain Transfer Protocol ¹. Reaching Ethereum within seven minutes and 21 seconds of the initial mint, the extracted assets were quickly liquidated ¹. The attacker swapped the 1.4 million AUSD on the 1inch aggregator within 84 seconds of arrival ¹.

Agora stated that it operates no contracts on Initia and affirmed that genuine AUSD reserves remain fully backed, though it later froze the recipient address after the funds were swapped ¹. Around 11:41 a.m. ET, the attacker transferred 1,135.5 ETH to a fresh wallet ¹. Initia has yet to publish a definitive post-mortem or formally verify loss totals ¹. At the time of writing, ETH traded at $2,380.