Initia has attributed the security incident that halted its blockchain and rollups to a bug in its MoveVM software, saying an attacker created unbacked balances and moved about $2.7 million of assets out before the shutdown.
The project's October 24 account, reproduced by The Industry Spread, identifies a flaw in script caching that allowed security checks to be bypassed. It says no native INIT was minted and the total supply of INIT was unaffected.
In that statement, Initia said its Layer 1 and rollups remained halted while a fix was prepared, with completion and an audit expected to take a few days. That is a repair estimate, not a confirmed restart date or evidence that an audit has finished.
Unbacked balances became claims on assets elsewhere
The distinction between creating a balance and extracting an asset is central to the incident. An unauthorized accounting entry can appear on one chain; turning it into spendable value elsewhere requires another system to accept the resulting claim.
Initia's account identifies about 105 WETH and 1.4 million AUSD0 moving through LayerZero-related routes, plus about 1.08 million USDC through Noble and Circle's Cross-Chain Transfer Protocol. The project says the proceeds were subsequently converted into 1,135.52 ETH on Ethereum.
The tokens named in the description of the unbacked credits and those named in the bridge-out are not identical lists. They should not be combined into a claim that every named asset was newly issued by its original issuer.
Face value is different from extracted value
Bitquery's independent transaction analysis estimates roughly $2.73 million in real assets paid out from bridge reserves. It distinguishes that outflow from a larger face-value amount of tokens created on Initia and identifies the Ethereum-side transactions used in its reconstruction.
These are overlapping descriptions of the same incident, rather than separate losses to add together. The eventual net loss will also depend on what can be frozen, returned or recovered. A wallet balance observed during an investigation is a dated observation, not a guarantee that the funds remain there.
The figures illustrate why a token's displayed quantity cannot establish its backing or realizable value. Our explanation of what DeFi total value locked measures sets out similar limits on treating headline balances as an assurance of available capital.
Kraken's public status feed still listed INIT deposits and withdrawals as paused when checked on October 25. That confirms an unresolved funding restriction at that exchange, rather than independently measuring block production on Initia.
Restoring the network is another task
Stopping a chain can limit further execution while a vulnerability is investigated, but it also interrupts the applications and transfers that depend on new blocks. Repairing the code, agreeing how to resume and recovering assets are separate steps.
A holder's native-token supply can remain unchanged while their ability to move assets is interrupted. Conversely, a token continuing to trade on an exchange does not by itself show that deposits and withdrawals on the underlying network are working.
The original halt was dated October 23 at 15:41:30 UTC. The latest project account cited here does not supply a final post-mortem, a confirmed recovery total or a reopening timetable. Those are the milestones needed to assess the resolution, rather than assuming that a software-fix estimate establishes normal service.