--- title: "Initia Halts Network as MoveVM Bug Enables $2.7M Cross-Chain Exploit" description: "An attacker minted unbacked tokens on Initia's Layer 1 and bridged assets to Ethereum through LayerZero adapters, leaving the chain offline without a restart timeline." url: https://basisdesk.news/news/initia-halts-network-movevm-exploit-layerzero published: 2026-10-24T02:41:25.640Z modified: 2026-10-24T02:41:25.640Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [INIT, ETH, AUSD, USDC] tags: [initia, movevm, layerzero, exploits, bridges, cosmos] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Initia Halts Network as MoveVM Bug Enables $2.7M Cross-Chain Exploit An attacker minted unbacked tokens on Initia's Layer 1 and bridged assets to Ethereum through LayerZero adapters, leaving the chain offline without a restart timeline. ## At a glance - **What happened:** An attacker exploited a MoveVM vulnerability on Initia to mint synthetic tokens and bridge out $2.7 million via LayerZero on Oct. 23, forcing an indefinite chain halt. - **Why it matters:** The breach drained significant bridge adapter reserves on Ethereum and exposes risks in cross-chain bridge verification when source-chain virtual machines suffer mint bugs. - **Who is affected:** Initia ecosystem users, network validators, and liquidity providers for drained LayerZero lockbox adapters on Ethereum. - **What's next:** Initia core developers and validators must deploy a software fix and agree on a coordinated restart procedure. - **Primary source:** [Initia Has No Restart Date After Attacker Mints Tokens and Bridges Out $2.7 Million](https://unchainedcrypto.com/initia-has-no-restart-date-after-attacker-mints-tokens-and-bridges-out-2-7-million/) — unchainedcrypto.com ## Key points - Initia paused its Layer 1 and rollups on Oct. 23 after an attacker exploited a MoveVM bug to extract $2.7 million [1]. - The attacker minted synthetic tokens on Initia and bridged them to Ethereum via LayerZero OFT adapters to drain real collateral [1]. - The chain has not established a restart timeline as the team evaluates the incident alongside validators and security analysts [1]. ## Editorial remark - **Context:** Initia pairs a Cosmos SDK foundation with a MoveVM execution layer. The incident highlights architectural vulnerabilities when non-native smart contract environments interact with cross-chain burn-and-mint bridges that rely on local chain state validity. - **Impact:** Holders of assets on Initia remain unable to transact or exit positions while rollups and the base layer remain frozen. Liquidity providers for OFT adapters on Ethereum sustained bridge depletion, particularly in native ETH and AUSD pools. - **Watch:** Initia's official post-mortem report, validator coordination on a network restart patch, and potential recovery measures for drained bridge adapters. Layer-1 blockchain Initia and its rollups remain offline following a security incident on Oct. 23 that permitted an attacker to illicitly mint and bridge out approximately $2.7 million in assets [1]. The network was paused at 11:41 a.m. ET after suspicious activity surfaced, with the core team coordinating with validators, exchanges, and security teams to evaluate the breach [1]. As of Oct. 24, the network has set no official restart date [1]. According to preliminary findings disclosed by Initia co-founder Zon, the breach stemmed from a zero-day vulnerability in Initia's MoveVM implementation on the Cosmos SDK [1]. The vulnerability permitted the attacker to mint auxiliary tokens directly on the Initia Layer 1, though Zon noted the bug did not impact native $INIT tokens [1]. Pseudonymous security researcher Spreek first detected the exploit at 11:27 a.m. ET, shortly before [Initia halted Layer 1 and rollups](https://basisdesk.news/news/initia-halts-l1-rollups-mint-exploit) [1]. ## Bridge Drain and Liquidation An analysis by D2 Finance revealed that the attacker initiated the exploit at 10:59 a.m. ET by minting 2 million unbacked units of a bridged representation of Agora's $AUSD on Initia [1]. The attacker then burned the unbacked tokens to trigger withdrawals via LayerZero to Ethereum [1]. Because LayerZero OFT lockbox adapters cannot verify whether burned tokens were originally backed, the Ethereum adapter unlocked genuine collateral [1]. In total, the exploiter drained 1.4 million AUSD—comprising 71% of that adapter's balance—alongside 105 $ETH and 1.08 million $USDC bridged via Circle's Cross-Chain Transfer Protocol [1]. Reaching Ethereum within seven minutes and 21 seconds of the initial mint, the extracted assets were quickly liquidated [1]. The attacker swapped the 1.4 million AUSD on the 1inch aggregator within 84 seconds of arrival [1]. Agora stated that it operates no contracts on Initia and affirmed that genuine AUSD reserves remain fully backed, though it later froze the recipient address after the funds were swapped [1]. Around 11:41 a.m. ET, the attacker transferred 1,135.5 ETH to a fresh wallet [1]. Initia has yet to publish a definitive post-mortem or formally verify loss totals [1]. At the time of writing, ETH traded at $2,380. ## Sources 1. [Initia Has No Restart Date After Attacker Mints Tokens and Bridges Out $2.7 Million](https://unchainedcrypto.com/initia-has-no-restart-date-after-attacker-mints-tokens-and-bridges-out-2-7-million/) — unchainedcrypto.com, 2026-10-24 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai