Initia Hack Drains USDC Bridge Reserves to $63 Amid Failed Withdrawals
An Initia network exploit on October 23 allowed an attacker to drain USDC bridge reserves down to $63 as withdrawal attempts failed.
Initia Hack Drains USDC Bridge Reserves to $63 Amid Failed Withdrawals
An Initia network exploit on October 23 allowed an attacker to drain USDC bridge reserves down to $63 as withdrawal attempts failed.
Initia USDC Bridge Depleted Following Security Exploit
USDC withdrawal attempts on Initia failed after an attacker depleted the reserves needed to cash out tokens held on the blockchain network, according to Bitquery's investigation of the October 23 exploit. The Noble blockchain held the USDC reserve backing representations of the stablecoin on Initia.
Bitquery found that this reserve fell from about $1 million before the cash-outs to an intraday low of $63 at 15:37 UTC on October 23. It reported roughly $24,000 at its later 18:52 UTC check that day. The firm counted 55 failed ordinary USDC withdrawal attempts before the halt, most from one bot repeatedly submitting the same balance. Larger withdrawal requests from the attacker also failed as the reserve ran short.
Network Halts and Estimated Losses
Initia announced that its L1 and rollups halted at 15:41:30 UTC on October 23. Co-founder @ItsAlwaysZonny initially estimated that about $3 million had been bridged out before the pause. Bitquery's estimate was about $3 million in real assets paid from bridge reserves, distinct from the roughly $7 million face value it assigned to unauthorized balances.
In an October 24 update, Initia attributed the exploit to a MoveVM script-caching bug that bypassed security checks. The project stated that the attacker created unbacked WETH, iUSD and USDC balances without changing their corresponding total supplies, and noted that no native INIT was minted.
Bridge Mechanism and Ongoing Recovery Efforts
In the mechanism Bitquery describes, legitimate tokens represented on Initia are backed by assets held elsewhere. Returning those representations requires the relevant reserve to release assets, while unauthorized balances let the attacker claim reserves without first depositing matching backing.
At 08:46 UTC on October 24, Initia reported that its L1 and rollups remained halted and expected a fix to be completed and audited within days while asset recovery was ongoing. The update supplied neither a firm restart date nor reimbursement terms, leaving how the missing bridge backing will be restored unresolved.
About The Author
