Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Breaches & attacks
LiveHighNo fix neededBreaches & attacks

Initia halts its L1 and rollups after a MoveVM mint bug lets an attacker bridge out about $2.7M

Initia L1 and rollups (MoveVM)

On Oct 23 2026 an attacker abused a previously unknown MoveVM / Cosmos SDK bug on Initia to mint about 2 million unbacked AUSD and bridge roughly 1.4M AUSD, 105 ETH and 1.08M USDC to Ethereum, about $2.65M to $2.73M. Initia halted the L1 and its rollups at 15:41:30 UTC. Native INIT was not affected. No fix, post-mortem or restart date had been published at the time.

Why this severity: ~$2.7M stolen; chain halted

Started
Oct 23, 2026

Follow this incident

Affected

  • Initia L1 and rollups (bridged assets)

Fixed in

No fixed release yet

Timeline1

  1. Attacker mints unbacked AUSD via a MoveVM bug and bridges ~$2.7M to Ethereum; Initia halts the L1 and rollups at 15:41:30 UTC.

Advisories1

News & write-ups2

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo