Initia Says MoveVM Flaw Enabled About $2.7M in Transfers

Initia said an attacker used a MoveVM script-caching flaw on Oct. 23 to bypass checks and transfer about $2.7 million in assets before the network was paused. The attack began at 10:59 a.m. ET (14:59 UTC), Initia said. The flaw let the attacker create false MoveVM state and receive unsupported balances in wrapped Ether (WETH), iUSD and USD Coin (USDC). The total supply of those tokens did not change, and no new INIT was minted. Before the pause, about 105 WETH and 1.4 million AUSD0 moved through LayerZero, while roughly 1.08 million USDC moved through Noble and CCTP.