movevm

【Market Flash】$2.7 million conjured out of thin air: Initia’s MoveVM cache vulnerability let attackers forge state and record uncollateralized balances. About 105 WETH, 1.4 million AUSD0, and 1.08 million USDC were then transferred out via cross-chain bridges.
“Shadow” assets were created, but no new INIT was issued. The flaw was in the execution layer.
The chain was halted on October 23; a patch is under review.
A ticking time bomb in the execution layer—are you worried?
$INIT $ETH $USDC
#INIT #MoveVM #Cross-chain
(Source: CryptoDaily)
⚠️Risk warning: The above is shared for informational purposes only and does not constitute investment advice. Investing involves risk; please exercise caution.

　　A cache vulnerability cost Initia approximately $2.7 million in just a few minutes. The attacker did not mint new INIT or alter the token’s total supply. Instead, they forged MoveVM state, crediting themselves with WETH, iUSD, and USDC that had no real backing—the balances appeared out of thin air, while real on-chain assets were transferred away.

　　The sequence is clear: at 22:59 on October 23 (UTC+8), the attacker exploited a MoveVM script cache vulnerability to bypass security checks. Before the network was paused, approximately 105 WETH and 1.4 million AUSD0 were transferred out via LayerZero, and about 1.08 million USDC via Noble and CCTP. The funds were then converted into 1,135.52 ETH, which is now sitting in an Ethereum address.

　　What makes this incident notable is that the total supply did not change and no INIT was minted, yet the stolen assets were very real. The L1 and Rollup remain paused, and the security fix is expected to be completed and audited within days. Work to recover the assets is also underway with security partners. For cross-chain bridges and the MoveVM ecosystem, once a cache-layer bypass like this has been demonstrated, the remediation details in the follow-up report may prove more useful than the dollar amount lost.$BTC #Initia #MoveVM

$ETH $USDC #Ethereum

Once a script cache is exploited, assets can be drained faster than an announcement can be issued.

Initia disclosed an attack exploiting a MoveVM script cache vulnerability: the attacker used it to transfer out approximately $2.7 million in assets, and the team says recovery efforts are ongoing. This kind of issue goes beyond a bug in the “business logic”; it concerns cache consistency at the execution layer. Once the same script path is compromised, on-chain checks may still make it “look legitimate.”

What to take away: This is a public lesson for Move-based chains and any execution environment that relies heavily on caching. After upgrades, first check whether cache invalidation policies, script-hash binding, and emergency pause switches can all take effect with a single action. Users should verify information through official channels and avoid phishing pages promising to “front-run recovery.”

#Initia #MoveVM #安全 #Onchain

　　A vulnerability in Initia’s MoveVM allowed attackers to forge state, enabling them to withdraw about $2.7 million.

　　The incident occurred on October 23 at 22:59 (UTC+8). According to Initia’s disclosure, the attackers exploited a MoveVM script cache vulnerability. After bypassing security checks, they forged MoveVM state and credited themselves with WETH, iUSD, and USDC that had no real backing. The key point is that this wasn’t a direct token mint: they made the state appear legitimate, bypassing the security checks.

　　About $2.7 million in on-chain funds was withdrawn, but Initia stressed that the total supply of the relevant tokens did not change, and $INIT was not newly issued either. In other words, the books were manipulated, but the total amount of tokens itself did not increase. For holders, clean supply figures don’t mean there were no losses; the actual flow of the stolen funds and how they are handled next are what to watch.

　　MoveVM has long touted type safety and its resource model. This issue arose in the script cache, an implementation detail of the execution layer. As more cross-chain and modular projects choose MoveVM as an execution environment, a gap in cache-layer validation can let forged state bypass checks that should have been enforced. Teams in the Move ecosystem should take note and review their own systems for similar issues.

$USDC #Initia #MoveVM #SecurityIncident

1、Background

Recently, security firm Hexens disclosed that it found a critical vulnerability in the Aptos blockchain Move virtual machine. The issue was quickly fixed after the report, and no on-chain funds loss occurred. According to publicly available information, the core of the vulnerability is related to a flaw in cache handling, which may lead to type confusion. For Aptos, which uses Move as its core execution environment, the sensitivity to such low-level defects is extremely high, because it affects not a single protocol but the entire execution layer’s trusted boundary. ⚠️

2、Vulnerability Analysis

From a technical perspective, Move is well known for resource safety and access control. Therefore, the key to this incident is not a typical smart contract logic error, but an abnormality at the virtual machine implementation level. If the cache mechanism mistakenly reuses or misidentifies types under certain conditions, an attacker could potentially bypass existing constraints and obtain high-privilege roles they should not have. In theory, this expands the attack surface from a single application to critical infrastructure such as stablecoin minting, cross-chain bridge verification, and DeFi governance modules.

Hexens also mentioned that the research team built a mainnet-proximate simulation environment at relatively low cost, and repeatedly validated the exploitation path—indicating the issue is not merely a paper risk, but has some real-world practicality. However, Aptos officials emphasized that exploitability in real environments is relatively low, reflecting a gap between “theoretically high severity” and “practical difficulty.” Objectively, such disagreements are not uncommon in security incidents. The focus remains that the vulnerability has been promptly patched.

3、Market and Ecosystem Impact

This incident sends two signals to the Aptos ecosystem. First, security for the underlying public chain cannot be judged solely by language design advantages; the virtual machine implementation, cache mechanisms, and execution optimizations can also be sources of systemic risk. Second, bug bounties, white-hat disclosures, and rapid remediation mechanisms are increasingly becoming an important component of a public chain’s competitiveness. Since no funds loss occurred, it essentially indicates that the ecosystem’s emergency response was effective. 🛡️

From a market perspective, short-term sentiment may be shaken by wording like “critical vulnerability.” But in the long run, what matters more are repair efficiency, transparency, and subsequent audit actions. If the official team can further clarify the scope of the patch, the validation process, and preventive measures for similar risks, it would actually help strengthen external confidence in Aptos’s technical governance capabilities.

4、Conclusion

Overall, this is not a black swan event that has already caused losses. Instead, it is a case that both exposed underlying execution risks and tested the project’s security response capabilities. At the current stage, investors should pay more attention to whether Aptos will further strengthen virtual machine audits, permission isolation, and defense-in-depth for critical infrastructure. For the industry as a whole, the core of public chain security is no longer just whether “the code can run,” but whether “the system can promptly detect and mitigate risks under high-pressure scenarios.” 📌

#Aptos #MoveVM #crypto

🚨 Ethical Hackers Prevented a Potential $70B Crypto Disaster

A team of ethical hackers from Hexens uncovered a critical vulnerability in the Aptos blockchain's Move Virtual Machine using nothing more than a $3,000 server.
$APT
$DL

The flaw reportedly had a nearly 90% success rate and could have undermined the core security guarantees of the Move programming language, potentially placing around $70 billion in crypto assets at risk.

Working responsibly, the researchers disclosed the issue to the Aptos team, allowing the vulnerability to be patched before it could be exploited.

This incident highlights the vital role of ethical hackers and proactive security audits in protecting the blockchain ecosystem.

#Aptos #CryptoSecurity #blockchain #EthicalHacking #MoveVM

$APT VULNERABILITY COULD RISK $700 BILLION – FIXED IN HOURS 🛡️

A critical vulnerability was discovered in Aptos Move VM in February, with a theoretical risk exposure of $700 billion across the ecosystem. The Aptos team patched the mainnet within hours, and no user funds were lost.

Hexens demonstrated a 90% attack success rate using only a $3,000 server, no validator access required. While real‑world exploitability was deemed minimal, the findings highlight how single VM flaws can cascade through bridges, stablecoins, and DeFi protocols.

Are you paying enough attention to underlying infrastructure risks in layer‑1 ecosystems?

Not financial advice. Always manage your risk.

#APT #Security #Vulnerability #MoveVM #Blockchain

🛡️

EthicalHackersFindAptosFlawRisking$70B
🚨 Web3 Security Alert: Ethical Hackers Save Aptos from a $70B Threat

A stark reminder of how critical white-hat hackers are to the blockchain ecosystem. A massive, business-critical vulnerability was just discovered and patched in the Aptos Network, which could have put an estimated $70 Billionin assets at risk.

Here is what went down:

🛡️ The Flaw:Ethical hackers identified a severe vulnerability lurking within the Move Virtual Machine (MoveVM)—the engine that powers Aptos's smart contracts.
•📉 The Risk:If exploited, the bug could have triggered catastrophic denial-of-service (DoS) crashes across network nodes or halted operations entirely, freezing billions in value.
💰 The Asymmetry:Shockingly, researchers noted that executing the exploit would have cost an attacker as little as $3,000
✅ The Resolution:The Aptos team moved fast to deploy a patch, successfully securing the network before malicious actors could take advantage of the loophole.

💡 The Big Takeaway

This is a textbook example of why robust bug bounty programs and continuous protocol audits aren't optional—they are foundational. Security in Web3 isn't a one-time milestone; it’s an ongoing battle. Kudos to the security researchers who caught this before disaster struck.

#CryptoSecurity #Blockchain #CyberSecurity #EthicalHacking #MoveVM

The counterfeit season quietly added a coin you might not have noticed 👀

MOVE (Move VM Layer2) today quietly made it into the top ten on the gainers list, +8.2%, and the structure is very clean—

📌 Where is it now?
- Current price: $0.00869
- 24H change: +8.19%
- Trading volume: ~9.3 million USDT
- Contract OI: 317 million MOVE

📌 How’s the structure?
- Funding rate: -0.026%, a slight short-term subsidy
- This indicates the rally is driven by spot demand, not leveraged futures piling it up
- OI shows no obvious abnormality—no hot pursuit/momentum-chasing signal

📌 What story is behind it?
In the alt-season, overall sentiment is spreading. As the next-generation smart contract virtual machine narrative, the Move VM track is seeing funds fold it into a “catch-up” sequence. The BNBChain Pasteur upgrade boosts ecosystem sentiment, benefiting the whole underdog L2/VM segment.

Not saying you must buy—just a reminder: when the gainers list shows a structure that not many people are talking about, yet it quietly runs up, it’s often a signal worth a second look in the mid-stage of an alt-season 👇

#MOVE #山寨季 #MoveVM #Layer2 #Binance Square

Click the card below to quickly check the market👇