Initia stays halted after a MoveVM script-caching bug
Initia's MoveVM script-caching bug bridged roughly $2.7 million before the L1 halt. Native INIT was left unminted, and Initia says the chain remains halted.
Initia's October 24 account draws a booking line that a halt headline flattens. A bug in the script cache of Initia's Move virtual machine (MoveVM) credited unbacked balances on a Layer 1 that remains halted, while the value that left was roughly $2.7 million, swapped into 1,135.52 Ethereum (ETH) on Ethereum mainnet. Native INIT was left unminted, so a larger float in that token is the wrong book for a loss Initia places in wrapped ether, AUSD0 and USD Coin (USDC).
At 14:59 UTC on October 23, 2026, Initia says, an attacker exploited that script-caching bug. Malicious code bypassed security checks and spoofed the MoveVM state. The October 23 post set the halt of the Initia Layer 1 (L1) and its rollups at 3:41:30 PM UTC, and said the team was working with security teams, validators and exchanges. The later post says the bridge-out was completed before the network was halted.
What Initia says left over the bridge
Initia put the outbound total at roughly $2.7 million: 105 Wrapped Ether (WETH) and about 1.4 million AUSD0 via LayerZero, along with about 1.08 million USDC via Noble and Circle's Cross-Chain Transfer Protocol (CCTP). Noble presents itself as stablecoin infrastructure, and Circle's page names CCTP as that protocol. Initia says the tokens were swapped for 1,135.52 ETH and, in that post, sit at 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8 on Ethereum mainnet.
The credit sentence and the bridge sentence name different tokens. Initia says the attacker was credited with unbacked WETH, iUSD and USDC, and that the credits left each corresponding token's total supply unchanged. The bridge sentence names 105 WETH, about 1.4 million AUSD0 and about 1.08 million USDC. iUSD appears only in the credit sentence, and AUSD0 appears only in the bridge sentence. A single stolen-stablecoin line would merge two lists the post keeps separate.
The native supply the bug left alone
"No native INIT was minted, and the total INIT supply is unaffected."
Initia published that line on October 24. On that account the bug spoofed MoveVM state and created unbacked balances, while the native supply is the figure the incident left as it was. Initia says a security fix is in progress, expects the fix to be completed and audited in a few days, and says asset recovery is ongoing with security partners. A full post-mortem is to follow, and readers are told to stay cautious of unofficial links, messages or claims.
What remains halted after the bridge-out
The October 24 post says the Initia L1 and the rollups remain halted while that work continues. Deposits, withdrawals and rollup traffic on those networks wait on the restart. The October 24 post places that ether at the mainnet address above, while the L1 stays halted.
The same date showed the venue pattern on a different network. THORChain v3.21 was set to halt at block 28,366,100, and MEXC paused RUNE deposits and withdrawals from 12:00 UTC on October 23, 2026, with 14:15 UTC on the venue notice. Initia's October 23 post put exchanges in the working group and left the firm names for a later update.
Coins can leave while the chain stays quiet. Blockstream's Liquid sidechain stayed frozen after white hats returned 3,400 of 4,000 Bitcoin (BTC), with 598.5 BTC and the peg still open, and with the last block recorded at 04:49 UTC on September 7, 2026.
The USDC leg runs on a third clock. About 1.08 million USDC moved via Noble and CCTP, and Circle's terms can delay a European USDC redemption for a desk that still holds the token. Initia says the bridged basket was swapped into ETH, so the balance named after the swap is ether at one address, on a different timer from an Initia restart.
Initia's homepage, opened on October 25, 2026, still leads with the interwoven-stack pitch at initia.xyz. The figures a desk can cite sit in the two posts. The next steps in the October 24 account are the patch, an audit expected in a few days, recovery with security partners, and a post-mortem after the L1 and the rollups resume. The resume time is left for that later update.
This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.
Reporting by Karthik Subramanian. Filed 25 October 2026, 10:07 GMT.
Digital Assets Correspondent
Karthik Subramanian is a founder, writer, and technology consultant with nine years in the crypto ecosystem.
