Initia Suffers $2.7M Exploit as Bithumb and Upbit Flag INIT as High-Risk

October 27, 2026 MM Crypto Team

What Happened to Initia

Initia was hit by a 2.7 million dollar exploit that has left the chain halted, its token flagged as high-risk by two of South Korea’s largest exchanges, and its community waiting for answers. According to technical data disclosed by the Initia team, the stolen funds were subsequently converted into 1,135.52 ETH via decentralised protocols, a classic laundering step that moves stolen assets into the most liquid cryptocurrency before they can be traced or frozen. Initia named a MoveVM script-caching bug as the cause of its 2.7 million dollar exploit, pointing to a flaw in how the virtual machine that executes smart contracts on the chain cached scripts. The chain is still halted with no restart date, which means no new blocks are being produced and users cannot transact at all. Loss estimates vary across trackers, with 2.6 million dollars cited by Spreek, around 3 million dollars by Bitquery, and 2.73 million dollars in Initia’s own breakdown, but the headline figure of 2.7 million dollars is the number the team and most coverage have settled on. The exploit is the latest in a string of costly DeFi incidents in 2026, and it is particularly damaging because it struck a young chain that was still building trust with users, exchanges, and developers. A halted chain with no restart date is the worst possible outcome for a project in that position, because every day of downtime erodes confidence and gives users a reason to move elsewhere. The Initia team is working alongside cybersecurity firms to complete a technical audit of the fix, and estimates indicate the definitive patch could be deployed in the coming days, while tracking and fund recovery efforts remain ongoing.

The MoveVM Script-Caching Bug Explained

The root cause named by Initia is a MoveVM script-caching bug, and understanding it requires a brief look at how the Move virtual machine works. Move is a smart contract language originally developed for Meta’s Diem project, and it powers a small but growing family of blockchains that prize its safety features, including a resource model designed to prevent the double-spending and re-entrancy bugs that have plagued other ecosystems. A virtual machine caches scripts to avoid re-verifying and re-loading the same code on every execution, which makes the chain faster. The bug, as described, lay in that caching layer: under certain conditions, a cached script could be executed in a context where it should not have been trusted, allowing the attacker to create balances that had no backing. Initia’s October 24 update says an attacker created unbacked WETH, iUSD and USDC balances, which means the attacker was able to mint or credit themselves with wrapped Ether and stablecoins that were not supported by any real deposits. That is the most dangerous kind of DeFi bug, because unbacked balances can be swapped for real assets before anyone notices the discrepancy. The Noble USDC reserve backing Initia fell from about 1 million dollars to 63 dollars at 15:37 UTC on October 23, a near-total collapse that shows how quickly the attacker drained the real reserves behind the synthetic balances. The speed of that drain, from a million dollars to almost nothing in a single event, suggests the attacker understood the bug deeply and had prepared the extraction in advance. For the wider Move ecosystem, the incident is a warning that even languages designed with safety in mind can harbour subtle bugs in their execution layers, and that caching, a performance optimisation, can become a security hole when the cache and the verifier disagree about what code is safe to run.

Exchanges React: Bithumb and Upbit Flag INIT

The market reaction came swiftly from South Korea, where INIT has a significant trading presence. Bithumb and Upbit flagged INIT as high-risk, a designation that carries real consequences for holders. South Korean digital asset legislation establishes strict oversight standards, and the guidelines of the User Protection Act require operators to limit retail investors’ financial exposure to active smart contract vulnerabilities. When an exchange designates a token as a cautionary or high-risk asset, it is signalling to its users that the token carries elevated danger, and in the Korean market that label often precedes trading restrictions or delisting. Upbit set a formal evaluation window regarding INIT’s continued listing, running from November 23 to 27, when its listing committee will decide whether to lift the caution designation, extend the investigation, or proceed with definitive delisting. That window gives Initia roughly a month to fix the chain, publish a credible forensic report, and convince the committee that the token is safe to trade again. A delisting from Upbit would be a severe blow, because Upbit is one of the largest exchanges in Korea and a major source of INIT liquidity, and losing it would shrink the token’s market and make recovery far harder. Bithumb’s parallel flag adds to the pressure, and together the two designations mean that the Korean market, which often drives outsized volume for smaller tokens, is now treating INIT as a distressed asset. The exchanges are acting within their regulatory obligations, and their caution is understandable, but the timing is brutal for a project that is already fighting to restart its chain.

The Market Picture: Price Up, But Derivatives Flash a Warning

The market data around INIT tells a strange and contradictory story. During trading on October 26, INIT was priced at 0.1589 dollars, up 5.9 percent over 24 hours, with a market cap around 33.5 million dollars on a circulating supply of 210.8 million tokens. A price rise in the middle of a chain halt and an exchange warning is unusual, and it likely reflects a mix of short covering, speculative buying by traders betting on a recovery, and the thin liquidity that makes small tokens move sharply on modest volume. The derivatives market tells a darker story. Open interest in INIT perpetual contracts hit 38.3 million dollars on October 26, surpassing the asset’s total spot market capitalisation. When the total value of outstanding leveraged bets exceeds the entire market value of the token, the market is stretched to an extreme. That imbalance means a sharp price move in either direction could trigger cascading liquidations, and it suggests that much of the recent trading is speculative leverage rather than genuine buying by long-term holders. High open interest relative to market cap is a classic red flag in smaller tokens, because it indicates that the derivatives tail is wagging the spot dog, and the price can be pushed around by leveraged positions that have little to do with the project’s fundamentals. For ordinary holders, the message is caution: a token that is up on the day can still be in deep trouble, and leveraged markets can reverse violently when news breaks. The combination of a halted chain, exchange warnings, and extreme derivatives positioning makes INIT one of the most fragile assets in the market right now, even with the green daily candle.

What Happens Next for Initia and Its Users

The road ahead for Initia is narrow, but it is not closed. The Initia team was expected to release the full exploit forensic report in the coming hours, and that document will be the single most important deliverable of the crisis. A credible forensic report needs to explain the bug in detail, show exactly how the attacker exploited it, account for every dollar of the loss, and lay out the fix and the additional audits that will prevent a repeat. Vague or delayed reporting will damage trust further, while a thorough report can begin the process of rebuilding it. The technical fix is the second milestone: the team is working with cybersecurity firms on an audit, and estimates indicate the definitive patch could be deployed in the coming days, but the chain remains halted with no restart date, and restarting a chain after an exploit is a delicate operation that requires validators to agree on the state of the ledger, including how to handle the unbacked balances the attacker created. The third milestone is the recovery effort, which remains ongoing, and the stolen funds converted into 1,135.52 ETH will be difficult to recover once they have moved through decentralised protocols, though on-chain tracking can still identify where they went. The fourth milestone is the Upbit evaluation window of November 23 to 27, which sets a hard deadline for the project to demonstrate that it has fixed the problem and is safe to trade. If Initia restarts cleanly, publishes a strong report, and keeps the exchanges onside, it can survive. If any of those steps fail, the project faces a long road back, and the exploit will join the list of incidents that ended promising chains before they had a chance to mature.

FAQ

What caused the Initia exploit? Initia named a MoveVM script-caching bug as the cause of its $2.7M exploit, which let an attacker create unbacked WETH, iUSD and USDC balances.

How much was stolen from Initia? The headline figure is $2.7M, with estimates varying from $2.6M to around $3M; the stolen funds were converted into 1,135.52 ETH via decentralised protocols.

Why did Bithumb and Upbit flag INIT? Both exchanges flagged INIT as high-risk after the exploit, and South Korea’s User Protection Act requires operators to limit retail exposure to active smart contract vulnerabilities.

Is the Initia chain still running? No, the chain is still halted with no restart date, while the team works with cybersecurity firms on an audit and a fix expected within days.

What is Upbit deciding in November? Upbit set an evaluation window of November 23–27, when its listing committee will decide whether to lift the caution designation, extend the investigation, or proceed with definitive delisting.

Source: Crypto-Economy

MM Crypto Analysis Web