Initia Halts L1 After MoveVM Bug Lets Attacker Mint $2.7M

Initia Freezes L1 and All Rollups

Initia halted its L1 blockchain and every rollup connected to it at 15:41:30 UTC on Friday, October 23, after what the team described as a security incident. The halt announcement, posted on the project's official X account, said the team is working with security firms, validators and exchanges to establish the full scope of the impact, and it warned users to treat unofficial links and claims circulating during the downtime with caution. On-chain data shows the chain stopped at block height 23,365,925, with no new block since. Roughly twenty minutes later, co-founder Ezaan Mangalji shared the first technical reading on X: a “Day 0” bug in the MoveVM execution environment that Initia runs on top of the Cosmos SDK allowed the attacker to mint additional tokens directly on the L1. MoveVM is the virtual machine that executes smart contracts written in the Move language, an uncommon choice for a Cosmos SDK chain, and Mangalji's “Day 0” framing means the flaw existed in the code from first deployment rather than arriving with a later update. He stressed that the native INIT token is not affected. Before validators could stop the chain, the attacker minted and bridged out about $2.7 million worth of AUSD, ETH and USDC. Mangalji did not disclose how the bug works, and no final loss figure has been confirmed. Initia's L1 coordinates interoperability and liquidity between its app-specific rollups, an arrangement one step removed from how a layer-3 blockchain stacks above a rollup, and validators that secure the network through staking were pulled into the investigation. For users the effect was total: deposits, swaps and cross-rollup transfers stopped at once. As of Saturday morning there was no restart time, no published bug detail and no remediation plan.

@initia · X post

Halt announcement.

View on X

Where the $2.7 Million Went

On-chain evidence fills in what the official statements left out. A security researcher posted a warning at 15:27 UTC, fourteen minutes before the halt, reporting that tokens had been minted in unlimited quantities and that roughly $2.6 million had already been cashed out, with more transfers in flight. Ethereum records show the attacker address 0xDD92...edFA had been active even earlier: at 15:03 UTC it routed 1.4 million AUSD through the 1inch aggregator in a single transaction, hash 0xeb5e85e76f00a7a84dfe4d2d6aab146a769785b3d80307c67dde14c79f36c5ae. Five seconds after the chain stopped, at 15:41:35 UTC, the same address moved 1,135.5 ETH to a fresh Ethereum address, 0x358e...CAC8. That transfer ran on Ethereum, so the halt could not touch it. As of Saturday morning the new address still held the full 1,135.5 ETH with no outgoing movement, worth roughly $2.7 million at ETH near $2,381, a figure consistent with Mangalji's estimate. Agora, the issuer of AUSD, responded twice overnight. It has no smart contracts deployed on Initia and no AUSD exists there; deployments on other networks are fully backed and operating normally, and its security team will freeze AUSD held by attacker addresses on chains where the token is deployed. Exchanges moved quickly. Upbit suspended INIT deposits and withdrawals at 15:57 UTC, citing signs of a security incident, and later warned clients that volatility could widen; Bithumb took the same step. Trading itself continued, and INIT swung between $0.114 and $0.156 over 24 hours, market data showing it near $0.138 early Saturday, up 4.6% after being up 12.5% earlier in the session, for a market cap near $29.2 million. The token still trades about 90% below its $1.42 high from May 2025, deep in bear-market territory.

What the Paper Trail Leaves Open

Taken together, the on-chain record and the team's statements leave an unusually clean paper trail. The minting transaction hash and the follow-up transfers are public and verifiable, and 1,135.5 ETH parked in a fresh address is the clearest recovery target; Agora's freeze order can claw back part of the AUSD on chains where it is deployed, though the ETH and USDC legs face no comparable remedy. The open question is the bug itself. No post-mortem, no root-cause disclosure, no restart date. Until Initia publishes a verified remediation plan, every rollup on the network stays frozen, and a Day 0 flaw in a MoveVM running on a Cosmos SDK chain is the detail other Move-based teams will be auditing this weekend.