Initia USDC bridge reserve falls to $63 after exploit

Bitquery found that an attacker depleted the reserves backing USDC tokens on Initia during the October 23 exploit, causing withdrawal attempts to fail. The Noble blockchain held the USDC reserve backing the tokens represented on Initia. Bitquery measured a decline from about $1 million before the withdrawals to an intraday low of $63 at 15:37 UTC on October 23. Bitquery recorded roughly $24,000 in the reserve during a subsequent check at 18:52 UTC that day.

Bitquery counted 55 failed ordinary USDC withdrawal attempts before the halt. Bitquery found that most attempts came from one bot repeatedly submitting the same balance. Larger withdrawal requests by the attacker also failed when the reserve became insufficient. Initia said the project's L1 and rollups stopped at 15:41:30 UTC on October 23.

Co-founder ItsAlwaysZonny initially estimated that about $3 million had left through bridges before the pause. Bitquery estimated that bridge reserves paid out about $3 million in real assets. Bitquery distinguished that payout from the roughly $7 million face value of the unauthorized balances.

Bitquery described legitimate tokens represented on Initia as claims backed by assets held on other blockchains. Bitquery explained that withdrawing those tokens requires the relevant reserve to release the backing assets. Bitquery said unauthorized balances allowed the attacker to claim reserve assets without making equivalent deposits first. Circle distinguishes third-party bridged tokens backed by USDC locked on another blockchain from native USDC that Circle issues and redeems for dollars. A depleted bridge reserve can therefore prevent withdrawals without establishing any failure in Circle's issuer-wide dollar backing.

Agora, a separate issuer, was involved through AUSD-related exposure. Agora said Agora's AUSD contract had not been deployed on Initia and no AUSD had been minted there. The affected exposure involved a separate third-party product using AUSD on Ethereum that Agora did not operate.

Initia attributed the exploit in an October 24 update to a MoveVM script-caching bug that allowed security checks to be bypassed. Initia said the attacker generated unbacked balances of WETH, iUSD and USDC while leaving the corresponding total supplies unchanged. Initia said no native INIT had been minted. At 08:46 UTC on October 24, Initia said the project's L1 and rollups were still halted. Initia expected completion and auditing of a fix within days. Asset recovery efforts continued. Initia provided no firm restart date or reimbursement terms, leaving the restoration of missing bridge backing unresolved.