Layer 1 blockchain Initia (INIT) announced via its official X that "Around 23:59 KST on the 23rd, an attack exploiting a script caching bug in Initia's MoveVM occurred. The attacker bypassed security checks, forged the MoveVM state, and allocated WETH, iUSD, and USDC tokens to themselves without actual collateral. The total supply of these tokens remained unchanged. Native INIT tokens were not minted, and the total supply of INIT was not affected. Before the network was halted, the attacker bridged approximately $2.7 million worth of assets externally, including 105 WETH and about 1.4 million AUSD0 via LayerZero, and approximately 1.08 million USDC via Noble and CCTP. The stolen funds were then swapped to 1135.52 ETH and are currently held in an Ethereum mainnet address (starting with 0x358). The team is currently implementing a security patch for the vulnerability and expects to complete it and an audit within several days. Asset recovery efforts are also underway in conjunction with security partners. Initia L1 and rollups are currently paused, and a post-mortem analysis report will be released after a safe network resumption," it explained.
