Initia Suffers $2.7M Exploit via MoveVM Script Cache Vulnerability
TREE NEWS reports: Initia, a Layer 1 blockchain network focused on modular rollups, has disclosed a security breach that resulted in the theft of approximately $2.7 million in digital assets. The attack, which occurred on October 23 at 22:59 Beijing time, exploited a vulnerability in Initia’s MoveVM script caching mechanism, allowing the attacker to bypass security checks and forge virtual machine states.
The attacker exploited the flaw to generate WETH, iUSD, and USDC tokens in their own account without changing the total token supply—meaning these assets lacked actual backing. The native INIT token was not minted, and its total supply remains unaffected. Before the network was paused, the attacker bridged out roughly $2.7 million in assets, including 105 WETH, about 1.4 million AUSD0, and 1.08 million USDC, through cross-chain channels such as LayerZero, Noble, and CCTP. The stolen assets were subsequently swapped for 1,135.52 ETH and are currently held at an Ethereum mainnet address.
Technical Breakdown and Immediate Response
The exploit highlights a critical weakness in the interaction between MoveVM’s script caching and state validation. By forging virtual machine states, the attacker could trick the system into accepting invalid token balances. Initia has paused both its L1 and rollup networks while it works on a fix, expected to be completed within days along with a security audit. The team is also collaborating with security partners to recover the assets.
This incident underscores the persistent risks in cross-chain infrastructure and the complexities of ensuring state integrity in modular blockchain architectures. The use of multiple bridging protocols (LayerZero, Noble, CCTP) to exfiltrate funds demonstrates how attackers can swiftly move assets across ecosystems, complicating recovery efforts.
Industry Implications and Forward Look
The Initia exploit is a reminder that even robust virtual machines like MoveVM can harbor subtle vulnerabilities in caching and state management. As modular and interconnected blockchain networks proliferate, the attack surface expands, particularly at the intersections of cross-chain communication and smart contract execution.
For Initia, the coming days will be critical: the team must not only patch the vulnerability but also restore confidence among users and investors. The asset recovery process, dependent on cooperation with security firms and potentially law enforcement, may be lengthy. The incident also raises questions about the adequacy of security audits for novel VM implementations and the need for real-time monitoring of abnormal minting events.
Investors and users should monitor Initia’s official channels for the network restart timeline and details of the remediation plan. The broader DeFi and cross-chain ecosystem may see increased scrutiny on script caching mechanisms and state validation processes, potentially leading to more rigorous audit standards for Move-based chains.
