Image Credit: brandfetch.com
- Initia halted its blockchain on October 23 following an exploit involving depleted reserves.
- Bitquery reported that the Noble reserve backing Initia fell significantly during the incident.
- Initia attributed the security breach to a script-caching bug within the MoveVM software.
USDC withdrawals failed during Initia’s Oct. 23 exploit after the reserve on Noble backing Initia’s USDC balances nearly emptied. Initia halted its base blockchain and connected rollups later that day, stopping transaction processing across those networks.
Bitquery Traces Failed Withdrawals to Depleted Reserves
Bitquery found that the USDC reserve held on Noble for Initia fell from approximately $1.09 million to $63 by 3:37 p.m. UTC on Oct. 23. A later check at 6:52 p.m. UTC showed approximately $24,000.
The attacker withdrew approximately 1.08 million USDC, while other users’ withdrawals reduced the remaining balance further. Larger requests from the attacker failed because the reserve lacked sufficient funds.
Bitquery counted 55 failed ordinary USDC withdrawal attempts before the network halt. Most came from one bot repeatedly submitting the same balance, so the figure does not represent 55 separate affected customers.
Initia Attributes Attack to MoveVM Software Bug
Initia said the attacker exploited a script-caching bug in MoveVM, the software that executes its Move smart contracts, at 2:59 p.m. UTC on Oct. 23. The flaw allowed malicious code to bypass security checks and create unbacked balances, according to its Oct. 24 account.
The team said the attacker credited itself with tokens without changing their recorded total supplies. It said native INIT tokens were not created through the exploit and their supply remained unchanged.
Bitquery estimated that approximately $2.73 million in real assets reached Ethereum through bridge withdrawals. That amount differs from the roughly $7.48 million face value it assigned to unauthorized balances, much of which could not be withdrawn.
Initia Plans Security Fix and Audit
Initia dated the network halt to 3:41:30 p.m. UTC on Oct. 23, approximately 42 minutes after the attack began. The team said it was investigating alongside security specialists, validators, and exchanges.
In its Oct. 24 update, Initia said it expected a security fix to be completed and audited within days. Asset-recovery work was continuing with security partners, but the update provided neither a firm restart date nor reimbursement terms for affected holders.
