Initia’s layer 1 and the rollups built on it are running again, ten days after an attacker used a bug in the network’s MoveVM to credit themselves with tokens that had nothing behind them and walk out with about $2.7 million through the bridges.
“The Initia L1 and rollups are now online and operational,” Initia said on Monday. The team added that bridges and exchanges are expected to resume transfers later in the day, and that the backing of AUSD0, USDC.n and WETH on the chain “have been fully restored”. A full post-mortem is due later this week.
The restart comes with limits. Withdrawals of the LayerZero OFT versions of WETH and AUSD0 will take 24 hours, and Noble USDC withdrawals will follow an hourly rate limit, Initia said. Those are the same three routes the attacker used to get value off the chain.
What went wrong on October 23
According to Initia’s incident statement, the attack began at 14:59 UTC on October 23. A bug in MoveVM’s script caching let malicious code bypass security checks, and the attacker spoofed the VM’s state to credit themselves with unbacked WETH, iUSD and USDC. The token supplies on record did not change, and Initia said no INIT was minted.
Before the chain was halted, the attacker bridged out 105 WETH and roughly 1.4 million AUSD0 through LayerZero, plus about 1.08 million USDC through Noble and Circle’s CCTP. All of it was swapped into 1,135.52 ETH on Ethereum. Co-founder Ezaan Mangalji, known as Zon, described it to The Block as a previously unknown “Day 0” bug in the network’s MoveVM implementation on Cosmos SDK.
The speed is the uncomfortable part. A reconstruction by the OnChain Attack Knowledge (OAK) project puts the last bridge exit 7 minutes and 21 seconds after the fake balances appeared. The L1 and all rollups were halted at 15:41 UTC, about 42 minutes after the first transaction. By then the AUSD exit had taken 71% of the balance held in the Ethereum-side AUSD adapter, and the ETH exit 96% of the native ETH adapter.
The bridges did what they were built to do. LayerZero’s verifiers attested burns that really happened on Initia. The adapters on Ethereum had no way of knowing the burned tokens were never backed, so they released real assets at par.
Where the money went
Initia said on October 24 that the 1,135.52 ETH was sitting in one Ethereum wallet. That did not last. OAK’s trace shows the wallet sending its whole balance onward from October 27, with 920 ETH deposited into Tornado Cash by October 28 and roughly 215 ETH split across ten fresh wallets. OAK also traced the attacker’s preparation funding to a Tornado Cash withdrawal earlier on October 23. No recovery has been announced.
Who paid for the shortfall
Because the bridged-out assets were real, the tokens left behind on Initia were short of backing. On October 28 the Initia Foundation said it had approved funding to restore 1:1 backing for the affected Noble USDC, WETH and AUSD0 held as iUSD collateral, covering verified shortfalls of up to 1.08 million USDC, 105 ETH and 1.4 million AUSD0. In short, the foundation is absorbing the loss so that holders on the chain are not left with diluted tokens.
Initia’s restart plan, published on October 30, said the upgrade would apply an independently audited MoveVM patch, isolate the attacker’s remaining forged balances and add security measures without rolling back transaction history. That last point matters. Other chains hit by state bugs have chosen to rewrite history, as Cronos did after its $75 million exploit. Initia instead says it is fencing off the forged balances and keeping every past transaction intact.
The plan also said the Initia DEX would start paused for a short window while a designated account rebalances pools toward market prices, with any profits from that rebalancing going back to affected liquidity providers. Ten days of frozen pools leave prices stale, and an open DEX at restart would hand easy arbitrage to whoever moved first.
How INIT is trading
The token has not behaved like a typical post-hack asset. The Block reported at the time that INIT fell 14% when the exploit became public and then reversed to trade 14% higher on the day. CoinGecko data showed INIT near $0.159 on Monday morning UTC, down about 10% over 24 hours and well below the roughly $0.22 it recorded on October 29, but still above its level before the exploit.
What to watch this week
Three things are still open. The first is whether exchanges actually reopen INIT deposits and withdrawals today, as Initia expects. The second is the post-mortem, which should say how long the script-caching bug existed and whether other MoveVM-based chains need to check their own code. The third is whether bridge rate limits stay in place. OAK’s write-up names per-route rate limits as the control that bounds this type of loss, and the new 24-hour delay on LayerZero withdrawals is exactly that kind of brake.
FAQ
Is the Initia network back online?
Yes. Initia said on November 2 that the L1 and its rollups are online and operational, with bridge and exchange transfers expected to resume later that day.
How much was taken in the Initia exploit?
About $2.7 million: 105 WETH, roughly 1.4 million AUSD0 and about 1.08 million USDC, which the attacker swapped into 1,135.52 ETH.
Were INIT tokens affected?
Initia said no INIT was minted and the total INIT supply is unaffected. The forged balances were in WETH, iUSD and USDC.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
