Web3 Daily Exploits — 24 Oct 2026: Initia ~$2.7M MoveVM Script Cache Unbacked Mint

The 24 Oct America/Panama window records one first-report protocol incident used for scoring. Initia, a Cosmos-SDK L1 with MoveVM support and associated rollups, lost approximately $2.7M after an attacker exploited a script-caching vulnerability in the MoveVM implementation. The bug allowed malicious code to bypass security checks, spoof MoveVM state, and credit the attacker with unbacked WETH, iUSD and USDC balances without altering the corresponding token total supplies. No native INIT was minted. Before the network was halted the attacker bridged the assets out via LayerZero (105 WETH and ~1.4M AUSD0) and Noble/CCTP (~1.08M USDC). The proceeds were swapped for 1,135.52 ETH that now sit on Ethereum mainnet. Official confirmation arrived from @initia on 24 Oct; researcher reports and on-chain tracing began on 23 Oct. Combined live loss on this card is about $2.7M. No other first-report smart-contract exploits with fresh scored loss figures were posted by the required monitors. The prior Solana $kimchi KOL-driven price spike and crash and a SlowMist DarkSword iOS malware alert remain notes or UPDATEs and are not re-scored.

Initia — Initia L1 / Ethereum — about $2.7M — MoveVM script-caching state spoof / unbacked mint then bridge

What happened: At approximately 14:59 UTC on 23 Oct 2026 an attacker exploited a bug in Initia’s MoveVM script caching. The flaw allowed malicious code to bypass security checks and artificially spoof the MoveVM state. The attacker credited their own account with unbacked WETH, iUSD and USDC tokens. Total supplies of those tokens did not change and no native INIT was minted. Before the L1 and rollups were paused the attacker bridged out roughly $2.7M: 105 WETH and approximately 1.4M AUSD0 via LayerZero, plus approximately 1.08M USDC via Noble and Circle CCTP. The tokens were subsequently swapped into 1,135.52 ETH, which currently reside at Ethereum address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. On-chain reconstructions (D2 Finance) describe a single signed transaction that minted 2,000,000 AUSD, followed within minutes by valid LayerZero messages that released real assets from Ethereum-side OFT adapters. The mint itself did not involve a bridge message; the destination adapters paid at par for the unbacked Initia-side balances. Initia co-founder Zon described it as a Day-0 bug in the MoveVM on Cosmos SDK. The network remains halted while a patch is prepared and audited; recovery efforts with security partners are ongoing. Official statement: https://x.com/initia/status/2113915002008612945.

Protocol / chain / asset: Initia L1 (MoveVM on Cosmos SDK) and associated rollups. Destination: Ethereum mainnet via LayerZero OFT adapters and CCTP. Assets: unbacked WETH, iUSD/AUSD0 and USDC credited on Initia, then released as real WETH, AUSD and USDC on Ethereum and swapped to ETH. Native INIT supply was unaffected.

Loss: Approximately $2.7M per the official Initia statement. Breakdown cited: 105 WETH + ~1.4M AUSD0 (LayerZero) + ~1.08M USDC (Noble/CCTP), consolidated into 1,135.52 ETH held at 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. Earlier researcher estimates (Spreek, D2 Finance) ranged from ~$2.6M to ~$2.65M in the minutes after the mint. Figures reflect the value of real assets released from the Ethereum-side adapters and CCTP. No additional external user-wallet drains outside the bridged amounts are included in the scored total.

Attack type: Logic / caching error in the MoveVM script cache that permitted state spoofing and credit of unbacked token balances without supply inflation. The subsequent bridge releases were honest responses to valid LayerZero messages generated from the spoofed balances. Not a classic reentrancy, not an oracle manipulation, and not a private-key compromise of Initia operators or the bridge. The inability of the OFT adapters to verify that burned/minted tokens on the source were ever backed made the exit practical.

Explorer URLs: Holding address on Ethereum: https://etherscan.io/address/0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. Ethereum explorer: https://etherscan.io/. Initia explorer details remain limited while the chain is halted; official channels are the primary source for on-chain reconstruction.

Status: Attack executed 23 Oct 2026 ~14:59 UTC. First public researcher reports (Spreek, D2 Finance) the same day. Official confirmation and detailed statement from @initia on 24 Oct. L1 and rollups remain halted. Patch and audit expected within days. Asset recovery efforts ongoing with security partners. No restart date announced. Users should remain cautious of unofficial links and await the post-mortem.

Sources: https://x.com/initia/status/2113915002008612945; https://x.com/D2_Finance/status/2113667420359700509; https://x.com/spreekaway/status/2113666660418687211.

Also noted

• $kimchi token on Solana (prior note, not scored): Lookonchain and subsequent coverage described a KOL-driven price spike to ~$14M market cap after @kimchi1x received 500M tokens and posted a promotion that was reposted by @a1lon9; both posts were later removed and the price crashed over 95%. Multiple wallets booked over $385K combined profit. No smart-contract vulnerability or protocol drain identified; user losses from the price crash are not included in scored live losses. Remains a note from the prior window. https://x.com/lookonchain/status/2113527634999279887.
• DarkSword iOS malware (new note, not scored): SlowMist posted a TI alert on 24 Oct about DarkSword targeting iPhone and iPad crypto users via iOS vulnerabilities that escape the sandbox and can steal Keychain credentials, locally stored wallet private keys and Notes data. Over 1,500 related phishing sites identified. Users advised to update iOS and avoid storing seed phrases in Notes. No specific on-chain loss figure attached. https://x.com/SlowMist_Team/status/2113861390335373779.
• Prior items (not re-scored): WAX Multi-Chain Bridge negative max_fee (~$90.5K), NEM LP burn (~$820K), Slice FundsModule, institutional MORPHO EIP-7702 and earlier incidents remain as previously briefed. No material new loss figures used for scoring.
• Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol exploits with fresh scored loss figures beyond the Initia detection and official confirmation.

Sources and references

• Initia official statement: https://x.com/initia/status/2113915002008612945
• D2 Finance on-chain decoding: https://x.com/D2_Finance/status/2113667420359700509
• Spreek initial report: https://x.com/spreekaway/status/2113666660418687211
• Holding address: https://etherscan.io/address/0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8
• SlowMist DarkSword alert: https://x.com/SlowMist_Team/status/2113861390335373779
• Lookonchain $kimchi (prior): https://x.com/lookonchain/status/2113527634999279887
• 23 Oct brief for WAX coverage: https://www.rektradar.xyz/web3-daily-exploits-23-oct-2026-wax-90k-bridge-neg-fee/
• Monitored accounts checked: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news. No additional first-report protocol exploits with fresh loss figures in the last 24 hours.

Editor’s note: the scored live loss on this card is approximately $2.7M from the Initia MoveVM script-caching flaw that enabled unbacked credit of WETH, iUSD and USDC, which were then bridged out via LayerZero and CCTP and swapped to 1,135.52 ETH on Ethereum. The attack occurred on 23 Oct; official confirmation and details were posted by @initia on 24 Oct. No other new first-report protocol drains with fresh figures were posted by the monitored accounts. The $kimchi Solana price crash and the DarkSword iOS alert remain notes and are not re-scored. No how-to or exploit reproduction steps. Stay tuned or stay rekt.