Initia Exploit Leaves USDC Reserves at $63 With No Restart Date

What is documented and what nobody has yet concluded divide cleanly in the Initia incident. A hack hit the Initia blockchain on Friday, October 23 (local time), and by 15:37 UTC that day the USDC reserves standing behind the network's withdrawals had collapsed from roughly $1 million to an intraday low of $63. Those reserves sat on the Noble blockchain, and on-chain data shows a recheck at 18:52 UTC found only about $24,000 left. Bitquery, the on-chain analytics firm behind the fullest public tracing of the flows so far, counted 55 failed USDC withdrawal attempts in the window before the halt; most came from a single bot re-submitting an identical balance, and the attacker's own larger withdrawal also failed once the reserve was gone. Initia halted both its layer-1 and its rollup at 15:41:30 UTC the same day, four minutes after the reserve low, stopping the run on the remaining funds. The route the attacker took is likewise established: unauthorized balances with no collateral behind them were used to pull value out of the bridge, which is what sealed ordinary users' withdrawal path, and for many the effect was simply that withdrawal transactions stopped executing against a depleted reserve. Initia's rollups operate as appchains on a shared layer-1, so a bridge failure at the base touches every token the network displays. The USDC price is not the moving variable in this event; the failure sits in a bridge protocol's custody layer, not in the stablecoin's dollar backing. What remains unsettled is everything after the halt: Initia has published no restart schedule and no compensation framework, so restoring the vanished bridge collateral is the open variable.

The size of the loss depends on which measure you use. Initia's co-founder first estimated the amount that left through the bridge before the halt at about $3 million. Bitquery, working from the reserve side, reached the same ballpark: roughly $3 million in real assets paid out of the bridge reserves, against a face value of about $7 million for the unauthorized balances. The mechanics explain the gap. Tokens displayed on Initia are claims backed by assets held on other chains, and reversing them requires the corresponding reserve to release the underlying asset; the attacker's unauthorized balances let value leave without any matching collateral ever being deposited. Circle's own classification places the incident in a narrow box: bridged USDC is a third-party token backed by USDC locked on another chain, while native USDC is issued by Circle and redeemable directly for dollars. A depleted reserve on one bridge can block that bridge's withdrawals without saying anything about the issuer's dollar backing, a separate pool that Circle's treasury team manages across multiple entities. Agora's AUSD was also raised in the discussion, but the AUSD official account stated that no AUSD contract was deployed on Initia and no AUSD was minted there; what was affected was a separate third-party product using AUSD on Ethereum, not an Agora-operated one. Initia's own post-mortem, in an October 24 update, named a MoveVM script caching bug that bypassed security verification as the root cause. The attacker used the flaw to create collateral-free WETH, iUSD and USDC balances, though the total supply of each asset was unchanged, and the network's governance token INIT was not additionally minted either; unchanged supplies may have made the unauthorized balances hard to separate from legitimate ones. As of 08:46 UTC on October 24 the L1 and rollup were still halted. Initia expects the fix within days, followed by an audit, and says asset recovery is underway, but that update carried no confirmed restart date and no compensation terms.

The line the evidence draws is precise. Confirmed: a script caching bug, a $63 reserve floor, about $3 million paid out and asset supplies untouched. Asserted but not yet proven: that recovery is progressing and that the fix is days away. What would settle the remaining doubt is a dated restart and a named source of funds to refill the bridge collateral; until Initia publishes both, the roughly $7 million face-value gap between what was created and what left stays the number to watch. Nothing in the on-chain record so far supports treating this as an issuer-level USDC problem.