Initia Discloses MoveVM cache vulnerability; approximately 2700000 USD in assets were transferred out
BIBIBI
AT A GLANCE
Initia said that a MoveVM script caching vulnerability was exploited, and approximately 2700000 USD in assets were transferred out before the network was paused.
Article
Initia Attack details disclosed:MoveVM A cache vulnerability led to approximately 2700000 USD being transferred out
PANews October 24 reported that Initia posted on X that the attacker, on October 23 22: 59（UTC+8) exploited Initia MoveVM a script caching vulnerability to bypass security checks and falsify MoveVM status, crediting themselves with unsupported WETH, iUSD, and USDC, with the total supply of the relevant tokens unchanged;INIT was not minted, and the total supply was unaffected. Before the network was paused, the attacker had transferred out approximately 2700000 USD in assets, including 105 tokens transferred via LayerZero WETH and approximately 1400000 tokens AUSD0, as well as approximately CCTP transferred via Noble and 1080000 tokens USDC, which were subsequently exchanged for 1135.52 tokens ETH, currently held at the Ethereum address 0x358ef0130f7a5aa516d...
PANews reported that Initia disclosed details of the attack on X.
02
Initia stated that the attacker, on October 23 22: 59（UTC+8) exploited MoveVM a script caching vulnerability to bypass security checks and falsify MoveVM status.
03
Initia said the attacker credited themselves with unsupported WETH, iUSD, and USDC, but the total supply of the relevant tokens did not change.
04
Initia said that INIT was not minted, and the total supply was unaffected.
05
Before the network was paused, the attacker had transferred out approximately 2700000 USD in assets, including 105 units WETH and approximately 1400000 units AUSD0, transferred out via LayerZero, as well as approximately CCTP transferred out via Noble and 1080000 units USDC。
06
The relevant assets were subsequently exchanged for 1135.52 units of ETH, currently held at the Ethereum address 0x358ef0130f7a5aa516d...。
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
The script caching vulnerability enabled the attacker to bypass the original security checks and forge the status of MoveVM records, making the account appear to hold unsupported assets. The disclosure said that, before the network was paused, the attacker transferred approximately 2700000 USD in assets through multiple channels and exchanged them for ETH；INIT was not minted.
Why it matters to readers
The incident shows that the security checks of Initia were bypassed and assets flowed out. Follow-up attention should focus on vulnerability remediation, network recovery, and whether the relevant funds continue to move.
Beginners should distinguish between “unsupported assets appearing in the state” and “an increase in total token supply”: the original text stated that the total supply of the relevant tokens did not change, and INIT was not minted either, but approximately 2700000 USD in assets were still transferred out.
Risks and unknowns
The available evidence is PANews’ account of the Initia post and does not provide the original X post for verification.
The evidence does not provide on-chain verification materials, so the specific fund flows and amounts cannot yet be independently confirmed.
Only a fragment of the Ethereum address is shown, so the complete address or subsequent fund movements cannot be verified based on the available evidence.
The evidence does not state whether the vulnerability has been fixed or whether the network has recovered.
Related Developments
Loading event timeline…
The evidence does not state whether the assets can be recovered or how the losses will be handled.
Related concepts
Script caching
This term is not in the glossary yet. Browse related concepts in the glossary.
