CryptoWorkPro

After an attack stops a blockchain, updates can sound like one story: "We are fixing it." A blockchain is a shared public ledger. Initia's incident has four separate steps. First, a fix is drafted. Next, the fix is audited, which means security experts check it. Then the backing for affected assets is restored. Backing means the real coins held in reserve behind a token. Last, the network restarts. Each step needs its own confirmation. This guide uses Initia's dated statements to show how to tell them apart.

What Initia has said, with dates

All times are UTC. These are Initia's own statements unless noted.

Oct. 23, 16:00:03. Initia said its main network (the L1) and the smaller networks built on it (rollups) had been halted since 15:41:30. It said the cause was a security incident.
Oct. 24, 08:46:25. Initia said an attacker used a bug at about 14:59 on Oct. 23. The bug was in MoveVM's script caching. MoveVM is the software that runs programs on Initia, and script caching is how it saves and reuses them. The bug let harmful code skip security checks. The attacker was credited with WETH, iUSD, and USDC tokens that had no backing. Initia says no native INIT was minted and total INIT supply was unaffected. It said roughly $2.7 million was bridged out before the halt. Bridged out means moved off Initia through bridges.
Oct. 27, 08:30:07. Initia said a fix for the vulnerability had been drafted. It said the fix is under audit with security partners. After the audits, it said, it will give concrete plans to restore the backing of affected assets. It will also give plans to restart the L1 and rollups in an orderly way. It said it expects to finish this process "in the coming days."

As of Oct. 27, the 08:30:07 post is the newest incident update on Initia's account. This article does not report the network's live state. Check the account for anything newer.

Four steps, four different questions

1. The fix is drafted. A proposed patch exists. That does not show yet that it works or that it is running on the network.

2. The audit finishes. Security partners check the fix. Initia says the audit is under way. It has not said the audit is complete.

3. Backing is restored. This step is about coins, not code. Bitquery explains how a bridge normally works. The bridge locks a real coin in a reserve on its home chain. Then it issues a copy on the other chain. The copy is only worth what the reserve can pay out. Fixing the software does not put coins back into a reserve. That is why Initia lists "restoring the backing of affected assets" as its own task. Initia says it will share plans after the audits.

4. The network restarts. This is when the network starts working again, with new blocks and transfers. Initia says an orderly restart comes after the audits and the backing plans. Its Oct. 27 post gives no restart time.

"In the coming days" is Initia's expectation. It is not a deadline.

What an independent trace shows

Bitquery is a blockchain data firm. It published its own trace of the incident. A trace follows coins from wallet to wallet on a public blockchain. Bitquery read the attacker's Ethereum wallets at 18:52 UTC on Oct. 23. It found about 1,135.5 ETH in one wallet. Initia's Oct. 24 post lists 1,135.52 ETH at an Ethereum address. The two accounts line up.

Bitquery puts the real coins that reached Ethereum at about $2.73 million. That is close to Initia's roughly $2.7 million. Both figures describe assets that left before the halt. Neither says how affected balances on Initia will be handled.

The limits matter. Bitquery's balances are a snapshot from Oct. 23, not current numbers. Bitquery did not audit the vulnerability. Its report does not show a total loss. Initia's explanation of the cause and its $2.7 million figure remain the project's own account.

Do not mix up AUSD0 and AUSD

Initia's Oct. 24 post lists AUSD0 among the assets that were bridged out. That is a different list from the tokens the attacker was credited with (WETH, iUSD, and USDC). Bitquery describes AUSD0 as the copy of Agora's AUSD on Initia.

On Oct. 23 (18:26 UTC), Agora said AUSD does not exist on Initia. It also said AUSD deployments and Agora operations continue as normal. That is Agora's statement about its own token. It does not say whether backing for assets on Initia has been restored.

What to do while you wait

Follow Initia's own account. The Initia website links to its X account, @initia. Open the account from that link, not from a message or a search result.
Expect no required action unless the account says so. Initia's three incident updates ask readers to be careful with unofficial links, messages, and claims. They do not ask users to take any step. They describe a bug in the network's software. They do not say individual wallets were compromised.
Check your exchange separately. Exchanges set their own deposit and withdrawal status for each coin and each network. A notice about one asset or network does not cover another. Look for the exact network name in the exchange's own notice.
Read each update for what it confirms. A drafted fix is not an audit. An audit is not restored backing. Restored backing is not a restart.

What is not yet confirmed

Initia's updates do not say the audit is finished. They do not say the fix is deployed or that backing is restored. They do not say when the network will restart. They make no promise of reimbursement.

Sources

Disclosure: This article reports Initia's public statements through Oct. 27, 2026, with times in UTC. It also uses one independent on-chain report. The cause and the $2.7 million figure are Initia's own account and may change. We did not audit the software fix or check live network status. Follow Initia's official account and your exchange's notices for current information. The illustration is conceptual, not a photo of a real event. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.

Market context

Initia's Fix Is Under Audit. Restoring Backing and Restarting Are Separate Steps