Four Minutes After Initia’s USDC Reserve Hit $63, the Chain Halted

On Friday, October 23, Initia halted its Layer 1 and its rollups after an attacker used what the project calls a flaw in its Move virtual machine to credit itself WETH, iUSD and USDC balances that nothing backed. The project says about $2.7 million moved out before the pause, and as of its October 24 update the chain was still stopped with no restart time given. Its full post-mortem has not been published.

This desk has not read Initia’s posts on X directly. What follows relies on reports that quote them, and says so where it matters.

What Initia says happened

Per ChainCatcher, which reported an Initia post, the attacker exploited a caching vulnerability in a MoveVM script to bypass security checks and forge MoveVM state. That let it credit itself with WETH, iUSD and USDC it had no backing for. Initia says the total supply of those tokens was unchanged and that no native INIT was minted. The Industry Spread puts the attack at 14:59 UTC and the halt at 15:41:30 UTC.

The money that left, per Initia as relayed by ChainCatcher: 105 WETH bridged through LayerZero, about 1.4 million AUSD0 through LayerZero, and about 1.08 million USDC sent through Noble and Circle’s CCTP, then swapped into 1,135.52 ETH now sitting at one Ethereum address. The total is roughly $2.7 million.

The reserve

Blockchain-data firm Bitquery, quoted by CryptoSlate, looked at the Noble-held USDC reserve that backs Initia’s USDC. It fell from about $1 million to an intraday low of $63 at 15:37 UTC. The halt came at 15:41:30 UTC, about four minutes later. A check at 18:52 UTC showed roughly $24,000.

Bitquery also counted 55 failed ordinary USDC withdrawal attempts before the halt, most from one bot resubmitting the same balance, and says larger attacker withdrawals failed once the reserve ran short. Fake and real USDC drew on the same pool, which is why the forged balances could crowd out honest users.

The numbers do not agree

Bitquery puts the real assets paid out of bridge reserves at about $3 million, with a chart figure of $2.73 million, and separates that from roughly $7.48 million in unauthorized balances at face value. The same $7.48 million appears in a SpendNode write-up of Bitquery’s work. Spreek’s early estimate, per The Defiant, was about $2.6 million cashed out. Initia says $2.7 million. A face value of $7 million is not a loss of $7 million: the attacker could only withdraw what the reserves held.

Related CoinDCX Says a Failed Sweep Job Cost It $16 Million. ZachXBT Says the ‘Retired’ Address Was Live for 10 Months

Token lists differ, too. The Industry Spread notes that Initia’s credit sentence names iUSD while its bridge-out sentence names AUSD0, and that it is unclear which list is complete. The Defiant reports that Agora froze the attacker’s AUSD account on Ethereum and says its AUSD contract is not deployed on Initia; Agora’s own statement was not read by this desk.

What is still open

No source this desk read says which script was cached, what check the cache skipped, whether the flaw sits in upstream Move code or Initia’s own changes, or whether other Move-based chains share it. Initia has promised a fix and audit within days, asset recovery with security partners, and a post-mortem with no date. It has given no reimbursement terms. The Industry Spread says it has not checked the primary posts either.

One thing the reports do establish: the halt followed the draining of the reserve, not the other way round. By Bitquery’s timestamps the USDC reserve was empty four minutes before the chain stopped, and per Initia the money was already out.