On Oct 23, 2026, an attacker exploited a previously unknown MoveVM-related bug on Initia to mint token balances without collateral. The tokens were bridged to Ethereum, draining the AUSD, ETH and USDC backing the bridged tokens. Estimated losses are about $2.6M–2.7M.
Initia's USDC reserve fell from about $1.09M to $63.
Initia halted its L1 and all rollups at 15:41 UTC that day. As of Oct 27, no restart date had been set. A fix is under security audit, and a recovery plan is due to be announced.
Upbit and Bithumb designated INIT a trading-warning asset on Oct 26. Upbit's designation took effect at 14:00 that day and will be reviewed in the fourth week of November. INIT deposits and withdrawals are suspended.
The unbacked tokens were used to withdraw real assets through the bridge, showing how one flaw in minting logic can put bridged assets at risk. Check your exchange's notices for deposit and withdrawal status, and use Initia's official channels to check restart updates and the recovery plan. Avoid links offering refunds or recovery.
