Initia Exploit Drains USDC Bridge Reserves to $63 Before Network Halt on October 23

Withdrawal attempts on the Initia blockchain failed after an attacker drained the USDC reserves backing token redemptions, triggering a network shutdown, per Bitquery’s forensic analysis of the October 23 incident.

On the Noble blockchain, reserves supporting USDC representations on Initia dropped from approximately $1 million to an intraday low of $63 at 15:37 UTC before partially recovering to around $24,000 by 18:52 UTC, according to Bitquery.

The analytics firm recorded 55 failed standard withdrawal attempts prior to the halt, predominantly from a single bot resubmitting identical requests. Larger withdrawal attempts from the attacker also encountered failures as reserves depleted.

@initia confirmed its Layer-1 chain and associated rollups paused at 15:41:30 UTC. Co-founder @ItsAlwaysZonny initially estimated $3 million in bridged assets exited before the suspension.

Bitquery assessed $3 million in actual reserves paid versus ~$7 million in face-value unauthorized balances created during the exploit.

How Reserve Depletion Blocked User Exits

As detailed by Bitquery, legitimate tokens on Initia rely on external reserves for redemption. When reserves backing specific assets are exhausted, exit mechanisms fail—even if broader stablecoin issuer solvency remains intact.

Circle clarifies that third-party bridged USDC differs from native USDC issued directly by Circle and redeemable for fiat. Draining bridge-specific reserves can freeze exits without compromising Circle’s centralized dollar backing.

The AUSD-related exposure involved a separate third-party contract on Ethereum; @withAUSD stated its AUSD contract was never deployed on Initia and no unauthorized issuance occurred there.

In an October 24 update, @initia attributed the exploit to a MoveVM script-caching vulnerability that bypassed validation checks. The attacker generated unbacked WETH, iUSD, and USDC balances without altering total supply figures. No native INIT tokens were minted, the team clarified.

At 08:46 UTC on October 24, @initia reported that Layer-1 and rollup systems remained offline while developers worked on a fix expected to complete within days. Asset recovery efforts were underway, though no timeline or reimbursement framework had been established for affected users.

Source link