MoveVM cache bug in Initia drained $2.7M from bridges

On October 23 an attacker exploited a script-cache flaw in Initia's MoveVM to credit unbacked WETH, iUSD and USDC on the L1. Within about seven minutes roughly $2.7M left Ethereum-side bridge reserves, was swapped into 1,135.52 ETH, and validators halted the L1 and all rollups at 15:41 UTC.

• Attack began at 14:59 UTC and cash-out took about seven minutes
• 105 ETH, 1.4M AUSD0 and 1.08M USDC were released, about $2.7M total
• Noble's USDC reserve for Initia fell from $1.09M to $63
• The 1,135.52 ETH sits in a wallet with zero transactions