Initia hack drove its USDC bridge reserve down to $63 as withdrawals failed

USDC withdrawal attempts on Initia failed after an attacker depleted the reserves needed to cash out tokens held on the blockchain network, according to Bitquery's investigation of the October 23 exploit.

The Noble blockchain held the USDC reserve backing representations of the stablecoin on Initia. Bitquery found that this reserve fell from about $1 million before the cash-outs to an intraday low of $63 at 15:37 UTC on October 23. It reported roughly $24,000 at its later 18:52 UTC check that day.

The firm counted 55 failed ordinary USDC withdrawal attempts before the halt, most from one bot repeatedly submitting the same balance. Larger withdrawal requests from the attacker also failed as the reserve ran short.

@initia said its L1 and rollups halted at 15:41:30 UTC on October 23. Co-founder @ItsAlwaysZonny initially estimated that about $3 million had been bridged out before the pause.

Bitquery's estimate was about $3 million in real assets paid from bridge reserves, distinct from the roughly $7 million face value it assigned to unauthorized balances.

How reserve losses blocked exits

In the mechanism Bitquery describes, legitimate tokens represented on Initia are backed by assets held elsewhere. Returning those representations requires the relevant reserve to release assets. Unauthorized balances let the attacker claim reserves without first depositing matching backing.

Circle's explanation of bridged and native USDC distinguishes third-party tokens backed by USDC locked on another blockchain from native USDC issued by Circle and redeemable for dollars. Depleting the reserve for a particular bridge can therefore obstruct exits without demonstrating a failure of Circle's issuer-wide dollar backing.

The AUSD-related exposure involved another issuer, Agora. Its @withAUSD account said its AUSD contract was not deployed on Initia and no AUSD was minted there. The affected exposure was a separate third-party product using AUSD on Ethereum that Agora did not operate.

In an October 24 update, @initia attributed the exploit to a MoveVM script-caching bug that bypassed security checks. It said the attacker created unbacked WETH, iUSD and USDC balances without changing their corresponding total supplies. No native INIT was minted, the project said.

At 08:46 UTC on October 24, @initia said its L1 and rollups remained halted and that it expected a fix to be completed and audited within days. Asset recovery was ongoing. That update supplied neither a firm restart date nor reimbursement terms, leaving how the missing bridge backing will be restored unresolved.