Initia USDC bridge reserve hits $63 low after exploit

Bitquery linked failed USDC withdrawal attempts on Initia to depleted reserves backing balances on the network following an exploit on October 23. The investigation found that the USDC reserve held on the Noble blockchain, which backs representations of the stablecoin on Initia, fell from approximately $1 million before the cash-outs to an intraday low of $63 at 15:37 UTC on October 23.

Bitquery reported that the reserve contained roughly $24,000 at a later check at 18:52 UTC that same day. The firm counted 55 failed ordinary USDC withdrawal attempts before the network halted. Most of these failed attempts originated from a single bot repeatedly submitting the same balance. Larger withdrawal requests from the attacker also failed as the reserve ran short.

Network halt and asset estimates

Initia stated that its Layer 1 and rollups halted at 15:41:30 UTC on October 23. Co-founder @ItsAlwaysZonny initially estimated that about $3 million had been bridged out before the pause. Bitquery’s estimate aligned with this figure, identifying about $3 million in real assets paid from bridge reserves. The firm distinguished this amount from the roughly $7 million face value it assigned to unauthorized balances created during the exploit.

The mechanism described by Bitquery indicates that legitimate tokens represented on Initia are backed by assets held elsewhere. Returning these representations requires the relevant reserve to release assets. The exploit allowed the attacker to claim reserves without first depositing matching backing, effectively draining the liquidity needed for standard withdrawals.

Technical cause and issuer distinctions

In an update on October 24, Initia attributed the exploit to a MoveVM script-caching bug that bypassed security checks. The project stated that the attacker created unbacked WETH, iUSD and USDC balances without changing their corresponding total supplies. No native INIT tokens were minted during the incident, according to the project.

Circle distinguished third-party tokens backed by USDC locked on another blockchain from native USDC issued by Circle and redeemable for dollars. Depleting the reserve for a particular bridge can obstruct exits without demonstrating a failure of Circle’s issuer-wide dollar backing. The AUSD-related exposure involved another issuer, Agora. The @withAUSD account stated that its AUSD contract was not deployed on Initia and no AUSD was minted there. The affected exposure was a separate third-party product using AUSD on Ethereum that Agora did not operate.

At 08:46 UTC on October 24, Initia said its L1 and rollups remained halted. The project expected a fix to be completed and audited within days of the update. Asset recovery was ongoing as of that time. The update supplied neither a firm restart date nor reimbursement terms, leaving the restoration of the missing bridge backing unresolved.