Initia blames a MoveVM script-caching flaw for its $2.7 million exploit, says the attacker now holds 1,135 ETH and keeps its chain paused for days

Initia has explained what hit it. In an update on Saturday, reported by KuCoin News, Phemex News and The Crypto Basic, the project said the attacker exploited a script-caching vulnerability in its MoveVM, the virtual machine that runs its smart contracts, to bypass security checks and forge the VM's state. That let the attacker credit their own account with WETH, iUSD and USDC that had nothing behind them.

The reports put the loss at about $2.7 million: 105 WETH, about 1.4 million AUSD0 sent out through the LayerZero bridge, and about 1.08 million USDC moved through Noble and Circle's CCTP transfer protocol. The attacker swapped everything into 1,135.52 ETH, which sits at a single Ethereum address. Initia stressed that its native INIT token was not minted and its total supply is unchanged.

The chain and its rollups remain paused. Initia said security patches should be completed and audited within several days, that asset recovery work is under way with security partners, and that a full post-incident review will follow, per the reports.

Cryptoweek reported on Friday that Initia had halted its blockchain after researchers flagged unauthorized minting of about $2.6 million; the project has now confirmed the figure at about $2.7 million and named the cause. What to watch next is whether the recovery effort claws any of the ETH back, and when the network restarts.