USDC withdrawal attempts on Initia failed after an attacker depleted the reserves needed to process token exits, according to Bitquery's investigation of an October 23 exploit.
The Noble blockchain held the USDC reserve backing representations of the stablecoin on Initia. Bitquery found that this reserve fell from approximately $1 million before the exploit to an intraday low of $63 at 15:37 UTC on October 23, with roughly $24,000 remaining at a later 18:52 UTC check that day.
Bitquery documented 55 failed ordinary USDC withdrawal attempts before the network halted, with most originating from a single bot repeatedly submitting requests. Larger withdrawal requests from the attacker also failed as the reserve ran depleted.
How the Reserve Depletion Blocked Exits
Legitimate tokens represented on Initia are backed by assets held on other blockchains. Returning those representations requires the relevant reserve to release assets. The attacker created unauthorized balances that claimed reserves without first depositing matching backing.
Bitquery estimated approximately $3 million in real assets were paid from bridge reserves, distinct from the roughly $7 million face value of unauthorized balances created in the attack.
Technical Details and Response
Initia halted its L1 and rollups at 15:41:30 UTC on October 23. In an October 24 update, the project attributed the exploit to a MoveVM script-caching bug that bypassed security checks. The attacker created unbacked WETH, iUSD, and USDC balances without changing their corresponding total supplies, the project said. No native INIT tokens were minted.
On October 24, Initia said it expected a fix to be completed and audited within days, with asset recovery ongoing. The update did not provide a firm restart date or reimbursement terms for the missing bridge backing.
