Initia hack drained USDC bridge reserve to $63

USDC bridge reserves collapse after exploit

An attacker exploited the Initia blockchain on October 23, 2026, depleting the reserves required to back USDC tokens on the network. As a result, the official USDC bridge reserve on the Noble blockchain dropped from approximately $1 million to a low of $63. This lack of backing prevented users from successfully withdrawing their USDC balances during the incident.

Initia is a Layer 1 blockchain that allows users to move tokens between different networks. To protect users, these bridges usually hold actual assets as "reserves" to back the digital tokens circulating on the connected networks.

Key numbers from the investigation

• Reserve status: The reserve fell to $63 at 15:37 UTC. A later check at 18:52 UTC showed the amount had recovered to approximately $24,000.


• Failed exits: Bitquery recorded 55 failed standard USDC withdrawal attempts before the system was paused. Most of these came from a single bot repeatedly trying to move the same balance.


• Financial impact: Bitquery estimates that about $3 million in real assets was paid out from the bridge reserves. This is separate from roughly $7 million in unauthorized balances that the attacker created.

What the Initia team said

The Initia team, operating under the handle @initia, confirmed that its main network and associated rollups (smaller networks built on top of a main blockchain) were halted at 15:41:30 UTC on October 23. Co-founder @ItsAlwaysZonny initially estimated that around $3 million was bridged out before the pause took effect.

In an update on October 24, the project identified the cause of the exploit as a "MoveVM script-caching bug." They stated that the attacker created unbacked balances for wrapped Ethereum (WETH), wrapped USDC, and a token called iUSD without actually changing the total supply. The team also noted that no native INIT tokens were minted during the attack.

Other claims about affected tokens

A separate stablecoin issuer, Agora, clarified that its AUSD token was not directly affected on the Initia network. The company stated that no AUSD was deployed or minted on Initia. They explained that any AUSD-related exposure involved a third-party product on the Ethereum network that Agora did not operate.

What is confirmed

It is confirmed that an exploit occurred on October 23, 2026, leading to a pause of the Initia network. The USDC bridge reserve on the Noble blockchain was significantly reduced, temporarily reaching $63. The project has identified a specific software bug as the cause of the unauthorized balance creation.

What is still unclear

The exact timeline for the network to restart has not been announced. While Initia stated it expected to complete a fix and audit within days, it did not provide a firm date for restoration. Details regarding how the missing bridge backing will be reimbursed to users are also currently unresolved.

Why this matters

This incident highlights the risks associated with blockchain bridges, which act as the connection points between different networks. When reserves are drained by an exploit, it can trap user funds even if the underlying currency, such as USDC, remains stable. For stablecoins specifically, bridging allows them to function on networks where they were not originally issued, but this depends on trust in the bridge's ability to redeem those tokens for the original asset.

What happens next

Initia is working on a patch to address the MoveVM bug and will conduct an audit. Asset recovery is ongoing. The team expects these technical fixes to be ready within a few days of their October 24 update.

Sources

• CryptoSlate