At 14:59 UTC on October 23rd, an attacker exploited a bug in Initia MoveVM’s script caching that allowed malicious code to bypass security checks. The attacker artificially spoofed the MoveVM state, thereby crediting themselves with unbacked WETH, iUSD, and USDC tokens without changing the corresponding token’s total supply. No native INIT was minted, and the total INIT supply is unaffected. Before the network was halted, the attacker bridged out roughly $2.7M, comprising of 105 WETH and ~1.4M AUSD0 via LayerZero along with ~1.08M USDC via Noble and CCTP. The tokens were swapped for 1,135.52 ETH and currently sit in 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8 on Ethereum Mainnet. We are actively working on a security fix to patch the identified vulnerability. We expect this to be completed and audited in a few days. Additionally, asset recovery efforts are ongoing with the help of security partners. The Initia L1 and Rollups remain halted as we work toward a resolution. We hope to safely resume network operations as soon as possible and will provide a full post-mortem once available. In the meantime, we will continue to share verified updates through our official channels. Please remain cautious of unofficial links, messages, or claims.

As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident. Our team is actively investigating the situation and working to establish the full scope of any impact with security teams, validators, and exchanges. We will share verified information through our official channels as it becomes available. Please remain cautious of unofficial links, messages, or claims circulating during this time.

Strat now offers $20k and $5k funded accounts. Choose your size, pass the eval, and keep 90% of the profits you make. Get funded today ↓

9:08 L.A. time. Back in the lab and shit.