Initia’s October 23 exploit looked like an unlimited mint.
The final mechanics are stranger.
Initia says a bug in MoveVM’s script caching let malicious code bypass security checks and spoof state so the attacker received unbacked WETH, iUSD and USDC balances.
The corresponding token total-supply counters did not increase, and no native INIT was minted.
Those fake balances were still accepted by bridging systems long enough for roughly $2.7 million of real assets to leave for Ethereum before Initia halted its Layer 1 and rollups.
The attack is a useful reminder that a supply counter can remain correct while the economic backing behind a bridged asset is being drained.
The Bug Was in Script Caching, Not the Stablecoin Issuers
Initia’s October 24 update attributes the exploit to a script-caching bug in its MoveVM implementation.
The attacker was able to make malicious code bypass expected security checks and manipulate the virtual machine’s view of state.
That produced balances that behaved as if assets existed even though the required backing had never been supplied.
Initia says native INIT was not affected.
Agora, the issuer of AUSD, also said its own AUSD contract was not deployed on Initia. The exploited representation depended on third-party bridging infrastructure rather than a failure of Agora’s issuer-wide backing.
A Fake Balance Can Still Claim a Real Reserve
Bridged assets generally work because real assets sit somewhere else while a representation circulates on the destination chain.
When a legitimate user exits, the destination-side representation is burned or otherwise retired and the bridge releases the corresponding backing asset.
The exploit created destination-side balances without the matching deposit step.
If the bridge believed those balances were legitimate, the attacker could redeem them against reserves that had been funded by real users.
That is how an accounting fiction inside one chain became a real loss on another.
The Supply Counter Stayed Flat Because the State Was Spoofed
This is why the phrase ‘minted tokens’ can be misleading here.
Initia says the attacker credited balances without changing the corresponding token total supplies.
From the user’s perspective, those balances were spendable enough to bridge out. From a conventional token-supply query, the accounting may not have shown equivalent new issuance.
Optimisus covered the opposite failure mode in Harmony’s exploit, where billions of unauthorized ONE tokens were created and the standard supply counter still failed to reflect the economic reality quickly enough.
Both incidents show why one supply metric is not sufficient to prove the state of a system.
The Bridge Reserve Became the Loss Absorber
Third-party analysis after the incident found withdrawal failures as reserves backing Initia representations were depleted.
Bitquery data cited by CryptoSlate showed the USDC reserve on Noble falling sharply during the exploit window.
The exact accounting across unauthorized balances, failed withdrawals and recoverable funds remains part of the incident response, and Initia has not published a final post-mortem or final user-loss figure as of October 26.
That uncertainty should be preserved rather than turning the preliminary $2.7 million bridged-out figure into a final audited loss number.
Halting the L1 Also Halted the Rollups
Initia is designed as an ecosystem of interconnected rollups, or Minitias, anchored to the Initia Layer 1.
When the team halted the base network, the rollups were halted as well.
That containment decision prevented more value from leaving while engineers patched the vulnerability, but it also exposed the shared operational dependency across the stack.
An appchain ecosystem can distribute execution across many rollups and still have one base-layer failure become an ecosystem-wide availability event.
The Security Boundary Is Larger Than the Smart Contract
Crypto security reviews often focus on a single contract or bridge.
This incident crossed several layers: a virtual machine implementation, the chain’s state model, bridged token representations and external reserve systems.
Optimisus recently made a similar point with the XRP Ledger’s decade-old overflow bug, where monetary safety ultimately depended on implementation details rather than the written fixed-supply rule.
The durable lesson from Initia is not simply ‘audit MoveVM more.’
A chain that lets an internal balance unlock value somewhere else has to prove the entire path from state creation to external redemption, including what happens when the internal state is wrong.
The bridge reserve paid for the bug because the system trusted the balance.
This is not financial advice.
Sources
- Initia – Official October 24 incident update – Primary project update attributing the incident to a MoveVM script-caching bug and describing the bridged-out assets; the project also said its L1 and rollups remained halted.
- The Block – Initia halts network after security incident – Independent reporting on the initial incident and preliminary loss estimate.
- CryptoSlate – Initia hack depleted USDC bridge reserve – Independent analysis of bridge-reserve depletion and failed withdrawals.
