Secure localization and velocity estimation are of great importance in Internet of Things (IoT) applications and are particularly challenging in the presence of malicious attacks. The problem becomes even more challenging in practical scenarios in which attack information is unknown and anchor node location uncertainties occur due to node mobility and falsification of malicious nodes. This challenging problem is investigated in this paper. With reasonable assumptions on the attack model and uncertainties, the secure localization and velocity estimation problem is formulated as an intractable maximum a posterior (MAP) problem. A variational-message-passing (VMP) based algorithm is proposed to approximate the true posterior distribution iteratively and find the closed-form estimates of the location and velocity securely. The identification of malicious nodes is also achieved in the meantime. The convergence of the proposed VMP-based algorithm is also discussed. Numerical simulations are finally conducted and the results show the VMP-based joint localization and velocity estimation algorithm can approach the Bayesian Cramer Rao bound and is superior to other secure algorithms.