Bitquery linked failed USDC withdrawals on the Initia network to an attacker depleting the reserve that backs them. Bitquery put the real assets paid out at about $3 million. Initia said it expects a fix and audit within days.
USDC withdrawal attempts on Initia failed after an attacker drained the reserves needed to cash out USDC tokens held on the network, according to Bitquery's investigation of the October 23 exploit. The reserve sat on the Noble blockchain and backed the stablecoin's representations on Initia.
The reserve fell to $63
Bitquery found the reserve fell from about $1 million to an intraday low of $63 at 15:37 UTC on October 23. By its later 18:52 UTC check, the reserve held roughly $24,000.
The firm counted 55 failed ordinary USDC withdrawal attempts before the halt, most from one bot repeatedly submitting the same balance. Larger withdrawal requests from the attacker also failed as the reserve ran short.
Halt and loss estimates
Initia said its L1 and rollups halted at 15:41:30 UTC on October 23. Co-founder @ItsAlwaysZonny initially estimated that about $3 million had been bridged out before the pause.
Bitquery's own estimate was about $3 million in real assets paid from bridge reserves, distinct from the roughly $7 million face value it assigned to unauthorized balances.
A caching bug and an open recovery
In an October 24 update, @initia attributed the exploit to a MoveVM script-caching bug that bypassed security checks. It said the attacker created unbacked WETH, iUSD and USDC balances without changing their corresponding total supplies. No native INIT was minted, the project said.
Circle's explanation of bridged USDC distinguishes third-party tokens backed by USDC locked on another blockchain from native USDC issued by Circle. Depleting the reserve for a particular bridge can therefore obstruct exits without demonstrating a failure of Circle's issuer-wide dollar backing.
At 08:46 UTC on October 24, @initia said its L1 and rollups remained halted and that it expected a fix to be completed and audited within days. Asset recovery was ongoing, but the update gave neither a firm restart date nor reimbursement terms.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
