On 23 October 2026 Initia halted its layer-1 chain and the rollups attached to it. The project’s clock for the stop is 15:41:30 UTC. The first public note said there had been a security incident and that the team was working with security firms, validators, and exchanges. A later note, on 24 October, named a cause and a figure. At 14:59 UTC on 23 October an attacker used a bug in Initia’s MoveVM script caching. Initia says the bug let malicious code bypass security checks and spoof the virtual machine’s state, crediting the attacker with unbacked WETH, iUSD, and USDC without changing those tokens’ total supply. No native INIT was minted. INIT’s total supply, the project says, is unaffected.
Before the halt, Initia says, the attacker bridged out roughly $2.7 million: 105 WETH and about 1.4 million AUSD0 through LayerZero, and about 1.08 million USDC through Noble and Circle’s Cross-Chain Transfer Protocol. Those proceeds were swapped for 1,135.52 ETH on Ethereum. The project said a fix was in progress and that it expected the patch to be finished and audited in a few days, that recovery work with security partners was underway, and that the chain and the rollups would stay halted until then. It promised a full post-mortem. As of that note, the post-mortem was not the note.
Updated on 5 November, from Initia’s own posts on 2 November. The project said the layer-1 and the rollups were online and operational. It said the backing of AUSD0, USDC.n, and WETH had been fully restored. Bridges and exchanges were expected to resume transfers later that day. Withdrawals of the LayerZero versions of WETH and AUSD0 were set to 24 hours, and Noble USDC withdrawals to an hourly limit. A full post-mortem was promised later that week. As of the evening of 5 November, this page has not found it. A restart is the chain accepting transactions again. It is not a refund of the 1,135.52 ETH, and it is not the post-mortem.
Updated on 11 November. The 10 November halt is still a new stop, not a revision of the October figures. Upbit, Bithumb, and Coinone said INIT withdrawals were paused because block production had stopped. Coinone’s reason line says a security issue. Trading on those venues stayed open. The first public accounts, from Coinlive and GetChain citing Initia, put the halt at 06:18 UTC and the early finding at about 605,000 USDC out through Noble, plus about $10,000 in other tokens. An earlier report that morning, from TechFlow, had quoted Initia saying a rollup pause had no impact on user funds and that the layer-1 was still running. ForkLog later quotes an Initia post the same day that replaces both of those sentences. About $3.27 million moved to an address on the paused chain. About $2.16 million of that is still there and cannot move. The $2.16 million is part of the $3.27 million, not a second pile, and neither figure is added to October’s $2.7 million. What left before the outbound limit, on that post, was 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC. No INIT was withdrawn. The early 605,000 USDC figure is that outbound slice, not a loss to place on top. Initia’s account of the path, at the level of the outcome, is that on 9 November a compromised cloud key led to further credentials, and that forged withdrawals from five rollups unlocked escrow on the layer-1. It says it intends to restore the backing of the affected assets in full, and that the plan is not finished. It is rebuilding the affected systems from scratch and expects the restart to take longer than a routine one. No date. A follow-up the same evening, as quoted elsewhere, says recovery work is going on with law enforcement and security partners. This page did not open the posts. It will not describe how the access was gained, and it will not describe how a withdrawal was forged.
What happened
Two clocks matter, and they are both the project’s. The bad state was credited at 14:59 UTC. The chain stopped at 15:41 UTC. Anything bridged in that window left while the chain was still accepting the bridge messages. A halt freezes what is still on Initia. It does not pull back assets a bridge already released on Ethereum. That is the product failure in one sentence: a balance Initia says was unbacked was good enough for a bridge to pay out real WETH, AUSD0, and USDC on the other side.
Initia has not said who bears that loss. A bridged token is a claim on a reserve held somewhere else, by a bridge adapter, an issuer, or a custodian. If the Initia-side token was unbacked and the Ethereum-side reserve still paid, the reserve’s depositors are the people short, unless someone else makes them whole. The project’s note does not identify that someone. See a bridge is extra software, not a tunnel. The tunnel metaphor is how this gets misread: the coins did not travel. A message on Initia caused a release somewhere else.
Do not mash this into Cosmos Hub restarted and moved 1,227,121 ATOM, a validator edit of one account, or into Arkadiko’s own vote installed a contract that emptied vaults, the day before. That was one app on Stacks, and Stacks did not stop. Do not mash it into Liquid’s unbacked L-BTC. That was a sidechain bug printing a bitcoin claim. This is a Move virtual machine on a Cosmos-SDK chain, and the project’s own line is that the native token’s supply did not grow. We will not describe the caching bug far enough to repeat it, and we will not publish the Ethereum address holding the swapped ETH. Initia published one. Phishing will publish a lookalike.
Why it matters
If you held INIT on Initia, the project says the supply you are a share of was not inflated in October, and the later post says no INIT was withdrawn in November either. The 2 November account said that halt was over and the chain was accepting transactions again. That is not the position after 10 November. The later post says about $2.16 million of the new movement is still on the paused chain and cannot move, and that the project intends to restore the backing in full. An intention is not a payment. Either halt is an availability decision by the people who run the chain. It is not a receipt, and it does not bring back what the bridges already paid out. If you held a bridged asset on Initia — WETH, a dollar token, USDC — you were holding a claim whose backing lives on another network, plus whatever Initia’s books said you had. Those are different ledgers. One of them, Initia says, was spoofed in October. The November post is a different hole, and a different dollar figure. If you held the same assets on Ethereum and never bridged to Initia, this page is someone else’s reserve.
“The chain paused, so the money is safe” is the reassuring version. The money Initia counts as bridged out was already on Ethereum before the pause. Recovery is a negotiation with whoever holds it now, and with the bridge and issuer contracts that released it. See What is DeFi? The support, when it exists, is the validator set that agreed to stop, and the security partners the project named without listing a refund.
What happens next
Whether the restart arrives, which Initia says will take longer than a routine one and has not dated. Whether the plan to restore backing in full is finished and then paid. The October post-mortem, which should still answer whose reserve paid the $2.7 million, and which was still missing on 5 November. The 24-hour and hourly withdrawal limits from the 2 November restart, which do not matter while the chain is stopped. Watch Initia’s own channels. An unofficial claim link is another incident, and it does not need a bug in a virtual machine. We will not add the $3.27 million to the $2.7 million, and we will not treat an intention to restore backing as a refund that has landed.
Not a recommendation to bridge, buy, or sell INIT or any asset that moved in this incident. Not an instruction to interact with an address posted as the attacker, the recovery, or the refund. The 2 November posts said the October halt was over and that backing had been restored. They are not the 10 November halt, and this page will not describe either one.
