Initia disclosed attack details: MoveVM cache vulnerability caused approximately 2.7 million USD to be transferred out
Initia posted on platform X that on October 23 at 22:59 (UTC+8), attackers exploited a caching vulnerability in the Initia MoveVM script to bypass security checks, forging MoveVM states to credit themselves with unsupported WETH, iUSD, and USDC, while the total supply of the related tokens remained unchanged; INIT was not minted, and the total supply was unaffected.Before the network was paused, the attackers had transferred out approximately $2.7 million in assets, including 105 WETH transferred via LayerZero and about 1.4 million AUSD0, as well as approximately 1.08 million USDC transferred via Noble and CCTP, which were then exchanged for 1135.52 ETH, currently held at the Ethereum address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. Initia stated that the security fix is expected to be completed and audited within a few days, and asset recovery efforts are being advanced with security partners. L1 and Rollup remain in a paused state, and a complete post-mortem report will be released subsequently.