Initia's USDC bridge reserve fell to $63. According to an investigation by the blockchain analytics firm Bitquery, reported by CryptoSlate, an exploit on October 23, 2026 let an attacker create token balances that were never backed by real deposits. Those fabricated balances drained the bridge faster than honest users could withdraw their own funds, and the chain was halted within minutes of the reserve bottoming out.
A caching bug that minted balances from nothing
The root cause was a MoveVM script-caching bug that bypassed the security checks meant to stop unbacked tokens from existing. Using it, the attacker created balances in WETH, iUSD, and USDC that no deposit ever funded. No native INIT tokens were minted, which kept the damage to bridged assets rather than the chain's own supply. At face value, the unauthorized balances added up to roughly $7.48 million of claims against reserves that did not exist to cover them.
A bridge works by holding a pool of real assets on one side and issuing representations of them on another. The model depends on one invariant: every unit on the destination chain is backed one-to-one by a locked deposit on the source side. The caching bug broke that invariant at the point it matters most, letting the attacker conjure the representation without ever locking the backing.
From $1.09 million to $63 in an afternoon
The USDC bridge reserve started the day holding about $1.09 million. By 15:37 UTC it had been drained to $63. Initia halted the chain at 15:41:30 UTC, roughly four minutes after the reserve bottomed out. A later check at 18:52 UTC showed it back at about $24,000, still a fraction of where it began. Across the assets the attacker touched, Bitquery put the real funds pulled from reserves at around $3 million before the halt stopped the bleeding.
The gap between the $7.48 million in fake balances and the roughly $3 million actually extracted is the reserve itself running dry. The attacker could mint unlimited claims but could only withdraw as much real value as the pool held. Once it was empty, the remaining fake balances had nothing left to take.
The mechanism that jammed honest withdrawals
Bitquery's finding was blunt: withdrawals failed because "unauthorized balances let the attacker claim reserves without first depositing matching backing." In plain terms, the attacker's fake USDC was indistinguishable from real USDC at the moment of withdrawal, so the bridge paid it out of the same pool that honest users were trying to draw from. There was no separate line for legitimate claims.
Bitquery counted 55 failed withdrawal attempts, most of them from a single bot repeatedly submitting the same balance against an empty reserve. For ordinary users, the experience was a withdrawal that simply would not complete, with no clear signal that the money backing their balance had already left.
Bridge reserves are only as solid as the code guarding them
Cross-chain bridges are among the most-attacked pieces of crypto infrastructure, and the reason is visible here. A bridged token is a promise, and the promise is only as good as the reserve standing behind it and the code that controls access to that reserve. When a single logic bug lets someone claim the reserve without funding it, every holder of that bridged asset is exposed at once, not just the direct victim.
That exposure reaches beyond traders. A growing share of stablecoin spending runs on balances that were bridged from one chain to another at some point, and the crypto cards and payment apps built on top of them inherit whatever solvency assumptions the bridge makes. Holding a bridged USDC balance carries the same core question as holding a custodial one: is the thing backing my balance actually there. The appeal of a card that lets you spend from your own wallet is that it shortens that chain of promises, but any asset that crossed a bridge to reach your wallet still carries the reserve risk from that crossing.
Initia said on October 24 that a patch and audit were expected within days, with asset recovery ongoing. No reimbursement terms and no INIT price reaction were disclosed at the time of writing.
Overview
A MoveVM script-caching bug on Initia let an attacker mint unbacked WETH, iUSD, and USDC balances on October 23, 2026, worth about $7.48 million at face value. The exploit drained the USDC bridge reserve from roughly $1.09 million to $63 before Initia halted the chain at 15:41:30 UTC, with Bitquery estimating around $3 million in real assets pulled from reserves. Honest withdrawals failed because the fake balances claimed the same reserve pool as legitimate ones, and a single bot accounted for most of the 55 failed exit attempts against the emptied reserve. As of October 24, Initia said a patch, audit, and asset recovery were in progress, with no reimbursement terms or token price impact disclosed. The episode is a reminder that a bridged token is only as safe as the reserve behind it and the code guarding access to that pool.
