Initia network suffers $2.7 million bridge exploit

A security incident on the Initia network on October 23 resulted in an exploit that drained approximately $2.7 million in assets. The attack targeted the network's bridges, where an attacker exploited a flaw in the MoveVM script cache to credit themselves with unbacked assets, including WETH, iUSD, and USDCon on the Initia Layer 1.

As the attacker bridged these unbacked tokens, real assets were released from Ethereum-side reserves. The stolen funds were subsequently swapped into approximately 1,135.52 ETH. On-chain analytics from Bitquery noted that the USDC bridge reserve via Noble fell from $1.09 million to a low of $63 during the attack. Additionally, 55 ordinary withdrawal attempts failed while the reserve was compromised.

Validators halted the Initia L1 and its associated rollups to mitigate the damage. While the bridges functioned as designed by releasing assets based on burned tokens, the underlying tokens on Initia were not backed by actual reserves due to the MoveVM bug. Initia has stated that the native INIT token supply remains unaffected.