A previously unknown vulnerability in Initia's MoveVM implementation on the Cosmos SDK enabled an attacker to mint 2 million unbacked AUSD stablecoin tokens on October 23, 2026, and bridge approximately $2.7 million worth of AUSD, ETH, and USDC to Ethereum before the network was halted. The explo...
"To the best of my knowledge, this is a Day 0 bug related to Initia's MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens." — Ezaan Mangalji, Co-founder, Initia
A previously unknown vulnerability in Initia's MoveVM implementation on the Cosmos SDK enabled an attacker to mint 2 million unbacked AUSD stablecoin tokens on October 23, 2026, and bridge approximately $2.7 million worth of AUSD, ETH, and USDC to Ethereum before the network was halted. The exploit — classified as an "infinimint" attack by blockchain security researcher Spreek — drained 71% of the AUSD bridge adapter balance and 96% of the native ETH adapter balance in under eight minutes.
Initia's Layer 1 blockchain and all connected rollups have been offline since 3:41 p.m. UTC on October 24, with no restart date announced. The incident is the second major MoveVM-related security event of 2026, following Hexens' disclosure in July that a type-confusion bug in the Aptos Move VM placed approximately $70 billion of theoretical value at risk. Both events raise questions about the maturity of MoveVM implementations across the Cosmos and standalone chains, even as the Move language's resource-oriented design is marketed on its inherent safety properties.
On-chain forensics published by D2 Finance provide a granular timeline of the attack.
Pre-exploit preparation: The attacker funded the wallet with 0.1 ETH from Tornado Cash at 08:27 UTC on October 23. Small transfers through AxelarHandler followed from 13:14 UTC, and 0.006 ETH was deposited into an ETH adapter at 14:37 UTC.
Token mint: At 14:59:26 UTC, a signed transaction created 2 million AUSD tokens on the Initia L1 without any collateral backing. The vulnerability allowed direct minting that bypassed the protocol's authorization controls.
Bridge exit: Approximately 153 seconds after the mint, a valid LayerZero message released 1.4 million real AUSD from the Ethereum bridge adapter. Within seven minutes and 21 seconds of the initial mint, approximately $2.65 million in assets had reached Ethereum.
Liquidation: The 1.4 million AUSD sat in the attacker's Ethereum wallet (0xDD922c841d85E12dac2dc2eef5a5E29cFFf6edFA) for roughly 84 seconds before being swapped via the 1inch aggregator. Additional funds were routed through 0x Protocol. The attacker ultimately extracted approximately 1.4 million AUSD, 105 ETH, and 1.08 million USDC.
The total elapsed time from mint to full extraction: under eight minutes.
Initia is a Layer 1 blockchain built on the Cosmos SDK that integrates the Move Virtual Machine — the same VM originally developed by Facebook's Diem project and now used by Aptos and Sui. The integration is non-trivial: Initia grafts MoveVM execution onto a Cosmos-native consensus and state management layer, creating a novel but relatively untested runtime environment.
According to Initia co-founder Ezaan Mangalji, the root cause is a "Day 0 bug" — a vulnerability present since deployment — in Initia's MoveVM implementation on CosmosSDK. The bug enabled unauthorized token minting on the L1 but did not extend to INIT, the network's native token.
The distinction matters. INIT tokens are managed through Cosmos SDK's native token module, while AUSD and other assets are handled through MoveVM smart contracts. The vulnerability appears to reside specifically in the interaction layer between MoveVM execution and the Cosmos SDK state, not in the Move language specification itself.
Initia has not published a full technical postmortem as of October 24. The team stated it was working "to establish the full scope of any impact with security teams, validators, and exchanges." No list of affected applications, individual user losses, or a restart schedule has been released.
The attacker used LayerZero's cross-chain messaging protocol to move minted tokens from Initia to Ethereum. D2 Finance traced the payouts to LayerZero adapters on Ethereum, which processed the fraudulent messages as valid cross-chain transfers.
The drainage was severe relative to adapter balances:
| Adapter | Pre-Exploit Balance | Amount Drained | % Drained | |---------|-------------------|----------------|-----------| | AUSD (LayerZero) | ~$1.97M | ~$1.4M | ~71% | | Native ETH | ~$109K | ~$105K (105 ETH) | ~96% |
This is the third significant security incident involving LayerZero bridge infrastructure in 2026. On April 18, the KelpDAO exploit drained $292 million after attackers forged a fake LayerZero message exploiting a 1-of-1 verifier configuration. On August 22, The Sandbox's SAND token cross-chain implementation on Base and BNB Smart Chain was exploited through LayerZero OFT peer and delegate abuse.
In the Initia case, LayerZero itself was not compromised. The protocol faithfully relayed what appeared to be a valid message from the Initia L1. The vulnerability was upstream — the minting bug created tokens that the bridge infrastructure treated as legitimate. This pattern — valid bridge messages carrying illegitimate assets — represents a distinct threat model from direct bridge exploits.
Initia: The network halted at 3:41 p.m. UTC on October 24. All L1 operations and connected rollups (Minitias) went offline simultaneously. The team is conducting an investigation with unnamed security firms.
Agora (AUSD issuer): Agora executed a batchFreeze transaction at 12:31:59 p.m. ET (approximately 89 minutes after the trade), freezing the attacker's Ethereum address. However, the address held no AUSD at that point — the tokens had been swapped away within 84 seconds of arrival. Agora stated it "has no smart contracts deployed on Initia" and that "AUSD does not exist on Initia." The issuer confirmed AUSD remains fully backed, with reserves held in a bankruptcy-remote Delaware Statutory Trust custodied by State Street and managed by VanEck.
INIT token market response: INIT fell 14% immediately after the exploit was reported, dropping to approximately $0.115 before recovering above $0.15 within the same trading day. At time of writing, INIT traded near $0.1496. Initia's market capitalization stands at approximately $30 million, with total value locked at $2.87 million — a fraction of larger Move-based ecosystems.
The Move language was designed with safety as a core principle. Its resource-oriented programming model treats digital assets as first-class types that cannot be copied or implicitly discarded — only moved between storage locations. This design eliminates entire vulnerability classes common in Solidity, including reentrancy attacks.
Despite these language-level protections, 2026 has exposed vulnerabilities at the VM implementation layer — the software that executes Move bytecode — rather than in the language specification itself.
Aptos type-confusion bug (disclosed July 4, 2026): Security firm Hexens identified a stale-cache bug in the Aptos Move VM that created a type-confusion vulnerability, allowing the VM to be tricked into treating one kind of on-chain resource as another. Using a server setup costing roughly $3,000, Hexens achieved a 90% success rate in simulated attacks across 20 attempts. The firm assessed that approximately $250 million of Aptos TVL was directly at risk, with theoretical systemic exposure reaching $70 billion when accounting for cross-chain bridges, stablecoins, and centralized exchange deposits. Aptos patched the vulnerability on February 27, 2026, before Hexens' public disclosure. No funds were lost.
Beosin stack overflow vulnerability (disclosed 2023): A recursive-call-based stack overflow affecting Sui (v1.2.1), Aptos (v1.4.3), and the Move-language reference implementation could cause total network shutdown. All affected chains patched before exploitation.
Initia infinimint bug (October 23, 2026): Unlike the Aptos incident, this vulnerability was exploited before detection, resulting in $2.7 million in actual losses. The bug resides in Initia's specific MoveVM-on-CosmosSDK integration, not in the shared Move VM codebase.
A pattern emerges: the Move language specification remains robust, but each chain's VM implementation introduces its own attack surface. The further a MoveVM implementation diverges from the reference design — as Initia's Cosmos SDK integration does — the greater the risk of novel vulnerabilities.
According to a 2025 research paper from arxiv.org, access control vulnerabilities were responsible for 58% of all Move smart contract losses, while capability leakage and ability misannotation represent ongoing concerns across MoveVM deployments.
Initia's architecture is a direct expression of the multi-VM thesis: a single L1 hosting rollups that can run EVM, MoveVM, or WasmVM execution environments. The design promises developers VM-agnostic deployment and users seamless interoperability.
The exploit exposes the cost of this flexibility. Each VM integration creates a unique interface with the underlying Cosmos SDK state layer. Auditing one VM integration (MoveVM) does not secure another (EVM, WasmVM). The combinatorial attack surface grows with each supported runtime.
Initia raised $24 million across seed, Series A, and community rounds from investors including Binance Labs, Delphi Ventures, Hack VC, Nascent, and Figment Capital. The project's all-time high token price of $1.44 (October 4, 2026) has since declined over 90% to current levels near $0.14, though the exploit accounts for only a portion of that decline.
With $2.87 million in TVL and a $30 million market cap, Initia remains a small-scale project. The economic damage of $2.7 million is manageable at the ecosystem level. The reputational damage to the multi-VM rollup thesis — and to MoveVM's security brand — may prove more consequential.
The Initia incident adds to a record year for DeFi exploits. As of late September 2026, DeFi protocols have suffered $1.84 billion in losses across 274 incidents, according to industry tracking data.
| Metric | 2026 YTD | |--------|----------| | Total DeFi losses | $1.84B across 274 incidents | | Largest single exploit | KelpDAO — $292M (April 18) | | Second largest | Drift Protocol — $285M (April) | | Year-over-year change (Jan-May) | +70% vs. 2025 | | Primary attack vector | Stolen keys/credentials (72% of losses) | | Lazarus Group attribution | ~$575M (44% of stolen funds) | | Ethereum incidents | 153 incidents, $522.8M lost | | Solana incidents | $315M lost (primarily Drift) |
The Initia exploit — at $2.7 million — is small by 2026 standards. Its significance lies not in the dollar amount but in the vulnerability class: a zero-day in a novel VM integration that enabled unauthorized token minting, a category of attack that the Move language was specifically designed to prevent at the specification level.
$2.7 million drained in under 8 minutes through a zero-day MoveVM vulnerability on Initia's Cosmos SDK implementation. The attacker minted 2 million unbacked AUSD tokens and bridged assets to Ethereum via LayerZero before the network was halted.
Network remains offline with no restart date. Initia's L1 and all connected rollups have been down since October 24. The team has not published a full postmortem, affected application list, or recovery timeline.
MoveVM implementation risk ≠ Move language risk. The vulnerability exists in Initia's specific integration of MoveVM with Cosmos SDK, not in the Move language specification. Aptos and Sui are not directly affected, but the Hexens disclosure in July showed that implementation-level bugs can affect even mature MoveVM deployments.
Bridge adapters as force multipliers. The attacker exploited a minting vulnerability but required LayerZero's bridge to extract value to Ethereum. Adapter balances — not protocol TVL — defined the practical exploit ceiling. Adapter liquidity is often unmonitored relative to the protocols they serve.
Freeze mechanisms proved too slow. Agora froze the attacker's address 89 minutes after the exploit, but the AUSD had been swapped away in 84 seconds. On-chain enforcement tools remain insufficient for real-time exploit containment.
2026 DeFi losses now approach $1.9 billion across 274+ incidents, with VM-level and bridge exploits accounting for some of the most technically sophisticated attacks of the year.
The Initia exploit is a $2.7 million incident with implications that extend beyond its dollar value. It demonstrates that porting a VM designed for one runtime environment (Move's original Diem/Aptos context) to another (Cosmos SDK) introduces vulnerabilities that neither the source VM nor the target framework was built to catch. The attack surface of multi-VM chains is not additive — it is multiplicative.
For the Move ecosystem, the year's record now includes a $70 billion theoretical exposure on Aptos (patched before exploitation) and a $2.7 million actual loss on Initia (exploited before detection). The divergence in outcomes correlates with ecosystem maturity: Aptos runs a well-funded, extensively audited MoveVM implementation; Initia runs a ported version on a different SDK with less audit coverage and a $30 million market cap.
For the broader market, the incident reinforces a structural lesson from 2026's $1.84 billion in DeFi losses: bridge adapter liquidity and cross-chain messaging protocols act as force multipliers for upstream vulnerabilities. An exploit that mints tokens on a low-TVL chain becomes a multi-million-dollar extraction when bridge adapters hold real assets on high-liquidity chains.
Initia's path forward depends on a transparent postmortem, a verified patch, and a restart that maintains state integrity across its rollup network. The longer the network stays offline, the harder that recovery becomes.