The Initia blockchain was hacked on October 23 via a MoveVM script-caching bug, allowing an attacker to create unauthorised token balances and drain the USDC bridge reserve from about $1 million to as low as $63 before the network halted, according to a report from CryptoSlate citing Bitquery's investigation. Withdrawal attempts failed as the reserve was depleted.
According to CryptoSlate's report on Bitquery's investigation, the attack on Initia depleted the USDC reserve needed to cash out tokens held on the blockchain. The Noble blockchain held the USDC reserve backing representations of the stablecoin on Initia. The reserve fell from about $1 million before the attack to a low of $63 at 15:37 UTC on October 23 and later recovered to roughly $24,000 at 18:52 UTC that same day.
CryptoSlate reported that Bitquery counted 55 failed ordinary USDC withdrawal attempts before the halt, most from one bot repeatedly submitting the same balance. Larger withdrawal requests from the attacker also failed as the reserve ran short.
The project's L1 and rollups halted at 15:41:30 UTC on October 23, according to @initia. Co-founder @ItsAlwaysZonny initially estimated that about $3 million had been bridged out before the pause. Bitquery's estimate was about $3 million in real assets paid from bridge reserves, distinct from the roughly $7 million face value it assigned to unauthorised balances.
In an October 24 update, @initia attributed the exploit to a MoveVM script-caching bug that had bypassed security checks. The attacker created unbacked WETH, iUSD and USDC balances without changing their corresponding total supplies. No native INIT was minted, the project said.
@initia stated that its L1 and rollups remained halted and that it expected a fix to be completed and audited within days. Asset recovery was ongoing, but the update supplied no firm restart date or reimbursement terms, leaving unresolved how the missing bridge backing will be restored.
The report also noted that the affected exposure involved another issuer, Agora, whose @withAUSD account said its AUSD contract was not deployed on Initia and no AUSD was minted there. The affected exposure was a separate third-party product using AUSD on Ethereum that Agora did not operate.
Analysis
Why This Matters
- The hack drained the USDC bridge reserve, causing failed withdrawals for users of the Initia network.
- It highlights vulnerabilities in cross-chain bridge mechanisms and script-caching bugs that can bypass security checks.
- The resolution of asset recovery and reimbursement for affected users remains uncertain, leaving trust in the network unaddressed.
Background
Initia is a blockchain network that uses a bridge mechanism to represent tokens from other blockchains. The hack exploited a bug in MoveVM script caching to create unauthorised token balances, which were then used to claim real assets from the bridge reserve. The reserve was held on the Noble blockchain, backing USDC representations on Initia. The incident occurred on October 23, 2026, and the network has been halted since then.
What to Watch
- The completion and audit of the fix, expected within days, and whether the network can resume operations.
- The announcement of reimbursement terms for users who lost funds due to failed withdrawals.
- Potential broader implications for other bridges using similar token representation mechanisms.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe Initia hack drove the USDC bridge reserve down to $63.CryptoSlate: “Bitquery found that this reserve fell from about $1 million before the cash-outs to an intraday low of $63 at 15:37 UTC on October 23.”
- SupportedInitia halted its L1 and rollups, stopping withdrawals.CryptoSlate: “@initia said its L1 and rollups halted at 15:41:30 UTC on October 23.”
- SupportedA MoveVM script-caching bug allowed the attacker to create unbacked balances and drain bridge reserves.CryptoSlate: “In an October 24 update, @initia attributed the exploit to a MoveVM script-caching bug that bypassed security checks. It said the attacker created unbacked WETH, iUSD and USDC balances without changing their corresponding total supplies.”
- SupportedThe attack occurred on October 23 and was attributed to the MoveVM script-caching bug.CryptoSlate: “In an October 24 update, @initia attributed the exploit to a MoveVM script-caching bug that bypassed security checks.”
- SupportedThe Noble blockchain held the USDC reserve backing stablecoin representations on Initia.CryptoSlate: “The Noble blockchain held the USDC reserve backing representations of the stablecoin on Initia.”
- SupportedThe reserve rose from a low of $63 at 15:37 UTC to roughly $24,000 at 18:52 UTC on October 23.CryptoSlate: “It reported roughly $24,000 at its later 18:52 UTC check that day.”
- SupportedBitquery counted 55 failed ordinary USDC withdrawals before the halt, most from one bot repeatedly submitting the same balance.CryptoSlate: “The firm counted 55 failed ordinary USDC withdrawal attempts before the halt, most from one bot repeatedly submitting the same balance.”
- SupportedLarger withdrawal requests from the attacker also failed as the reserve ran short.CryptoSlate: “Larger withdrawal requests from the attacker also failed as the reserve ran short.”
- SupportedThe co-founder initially estimated about $3 million had been bridged out; Bitquery estimated about $3 million in real assets paid from reserves, distinct from roughly $7 million in unauthorised balances.CryptoSlate: “Co-founder @ItsAlwaysZonny initially estimated that about $3 million had been bridged out before the pause. Bitquery's estimate was about $3 million in real assets paid from bridge reserves, distinct from the roughly $7 million face value it assigned to unauthorized balances.”
- SupportedThe attacker created unbacked WETH, iUSD and USDC balances without changing their corresponding total supplies.CryptoSlate: “It said the attacker created unbacked WETH, iUSD and USDC balances without changing their corresponding total supplies.”
- SupportedNo native INIT was minted, and the project expected a fix to be completed and audited within days while recovery was ongoing.CryptoSlate: “No native INIT was minted, the project said. At 08:46 UTC on October 24, @initia said its L1 and rollups remained halted and that it expected a fix to be completed and audited within days. Asset recovery was ongoing.”
- SupportedAgora said its AUSD contract was not deployed on Initia and no AUSD was minted there; the exposure involved a separate Ethereum product Agora did not operate.CryptoSlate: “Its @withAUSD account said its AUSD contract was not deployed on Initia and no AUSD was minted there. The affected exposure was a separate third-party product using AUSD on Ethereum that Agora did not operate.”