Initia disclosed on Oct 23 that an attacker exploited a MoveVM script caching vulnerability to bypass security checks and forge VM state, minting unsupported WETH, iUSD, and USDC to their own account. Total token supply remained unchanged, and INIT was not inflated. Before the network was halted, the attacker drained approximately $2.7 million in assets, including 105 WETH and ~1.4 million AUSD0 bridged via LayerZero, plus ~1.08 million USDC transferred through Noble and CCTP. The stolen funds were subsequently swapped into 1,135.52 ETH, now held at Ethereum address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. Initia said security fixes are expected within days pending audit, asset recovery efforts are underway with security partners, and both L1 and Rollup remain paused until a full post-mortem is published.