On 23 October 2026 Initia halted its layer-1 chain and the rollups attached to it. The project’s clock for the stop is 15:41:30 UTC. The first public note said there had been a security incident and that the team was working with security firms, validators, and exchanges. A later note, on 24 October, named a cause and a figure. At 14:59 UTC on 23 October an attacker used a bug in Initia’s MoveVM script caching. Initia says the bug let malicious code bypass security checks and spoof the virtual machine’s state, crediting the attacker with unbacked WETH, iUSD, and USDC without changing those tokens’ total supply. No native INIT was minted. INIT’s total supply, the project says, is unaffected.
Before the halt, Initia says, the attacker bridged out roughly $2.7 million: 105 WETH and about 1.4 million AUSD0 through LayerZero, and about 1.08 million USDC through Noble and Circle’s Cross-Chain Transfer Protocol. Those proceeds were swapped for 1,135.52 ETH on Ethereum. The project said a fix was in progress and that it expected the patch to be finished and audited in a few days, that recovery work with security partners was underway, and that the chain and the rollups would stay halted until then. It promised a full post-mortem. As of that note, the post-mortem was not the note.
What happened
Two clocks matter, and they are both the project’s. The bad state was credited at 14:59 UTC. The chain stopped at 15:41 UTC. Anything bridged in that window left while the chain was still accepting the bridge messages. A halt freezes what is still on Initia. It does not pull back assets a bridge already released on Ethereum. That is the product failure in one sentence: a balance Initia says was unbacked was good enough for a bridge to pay out real WETH, AUSD0, and USDC on the other side.
Initia has not said who bears that loss. A bridged token is a claim on a reserve held somewhere else, by a bridge adapter, an issuer, or a custodian. If the Initia-side token was unbacked and the Ethereum-side reserve still paid, the reserve’s depositors are the people short, unless someone else makes them whole. The project’s note does not identify that someone. See a bridge is extra software, not a tunnel. The tunnel metaphor is how this gets misread: the coins did not travel. A message on Initia caused a release somewhere else.
Do not mash this into Cosmos Hub restarted and moved 1,227,121 ATOM, a validator edit of one account, or into Arkadiko’s own vote installed a contract that emptied vaults, the day before. That was one app on Stacks, and Stacks did not stop. Do not mash it into Liquid’s unbacked L-BTC. That was a sidechain bug printing a bitcoin claim. This is a Move virtual machine on a Cosmos-SDK chain, and the project’s own line is that the native token’s supply did not grow. We will not describe the caching bug far enough to repeat it, and we will not publish the Ethereum address holding the swapped ETH. Initia published one. Phishing will publish a lookalike.
Why it matters
If you held INIT on Initia, the project says the supply you are a share of was not inflated. You still cannot move it while the chain is halted. A halt is an availability decision by the people who run the chain. It is not a receipt. If you held a bridged asset on Initia — WETH, a dollar token, USDC — you were holding a claim whose backing lives on another network, plus whatever Initia’s books said you had. Those are different ledgers. One of them, Initia says, was spoofed. If you held the same assets on Ethereum and never bridged to Initia, this page is someone else’s reserve.
“The chain paused, so the money is safe” is the reassuring version. The money Initia counts as bridged out was already on Ethereum before the pause. Recovery is a negotiation with whoever holds it now, and with the bridge and issuer contracts that released it. See DeFi is software with rules you cannot call support about. The support, when it exists, is the validator set that agreed to stop, and the security partners the project named without listing a refund.
What happens next
A patch, an audit the project said it wants before restart, and a post-mortem that should answer whose reserve paid the $2.7 million. A restart without that answer would turn the chain back on while the loss is still a rumour with a precise ETH total. Watch Initia’s own channels. An unofficial claim link is the second incident, and it does not need a bug in a virtual machine.
Not a recommendation to bridge, buy, or sell INIT or any asset that moved in this incident. Not an instruction to interact with an address posted as the attacker, the recovery, or the refund.
