← The Polylog Crypto Intelligence Brief
Morning Edition · Monday, October 26, 2026Published at 1:45 AM EDT · New York
Initia Exploit Minted Unbacked Tokens and Emptied Its USDC Bridge Reserve to $63
A caching bug in Initia's Move virtual machine let an attacker create about $7.48 million in unbacked balances and bridge out roughly $2.7 million before the chain halted, and no restart or reimbursement has been announced.
Initia, a layer-1 network built on the Cosmos SDK that runs its own rollups, halted its main chain and rollups at 15:41:30 UTC on Oct. 23 after an attacker minted tokens that no collateral backed. Crypto Adventure reports that the attacker used a script-caching bug in Initia's implementation of MoveVM, the virtual machine that runs its smart contracts. The bug let the attacker create balances of wrapped ether (WETH), iUSD and USDC on the Initia layer 1. Initia said the native INIT token was not affected.
The attacker turned the fake balances into real assets by moving them out through the bridges. ForkLog reports that about $2.7 million in AUSD, ether and USDC left before the halt. At face value the unbacked balances totaled about $7.48 million. On-chain data firm Bitquery, cited by CryptoSlate, found that the USDC bridge reserve fell from about $1 million to $63. Bitquery counted 55 failed ordinary USDC withdrawals as honest users tried to leave against an empty reserve.
Initia has outlined a fix and an audit to be completed within days. SpendNode notes that the project has not set a restart date or announced reimbursement. No attacker has been identified and no frozen funds have been reported.
The incident fits a familiar pattern of unauthorized-mint exploits. The bug sat in the execution layer, but the losses landed on a pooled lockup reserve, and users who arrived last found it empty. Holders of wrapped assets on Initia now hold claims against a reserve that no longer matches the supply on the chain.
What this means
Bridged assets are only as good as the smallest reserve behind them. Once a mint bug creates supply on the destination chain, the first people to withdraw take the real collateral and everyone else holds an IOU. Initia's wrapped-asset holders and liquidity providers are exposed, along with any rollup in its network that accepted the inflated balances as collateral. The open question is whether Initia rolls state back to before the exploit or socializes the shortfall. Each choice has a cost. A rollback undoes the attack but asks validators to rewrite history, while socializing spreads the loss across honest holders. Cosmos-based chains have halted and coordinated recoveries before, as BNB Chain did after its October 2022 bridge exploit, so a coordinated restart with some form of state fix is the likelier outcome within weeks. The read would be wrong if Initia restarts without addressing the unbacked supply, which would leave wrapped USDC on the chain trading at a discount until the gap is closed.
Part of a tracked trend
Bridge and Mint Exploits Sustain Heavy DeFi Losses
Over 3-6 months, recurring bridge proof-validation and unauthorized-mint exploits keep monthly DeFi losses elevated, including drains of deprecated contracts.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Electrum Patches Flaw That Let Malicious Servers Steal Bitcoin During Fee Bumps
- Flash-Loan Governance Takeover Drains About $4.85 Million From X100 on Ethereum
- CoinDCX Admits $15.99 Million USDT Loss From Retired Wallets After Chief Executive Called Reports a False Alarm
- Bitget Hacker Resumes Laundering as October's Security Roundup Adds Ledger Implants and Balancer's Wind-Down
- A Live Ethereum Rollup Drops Elliptic-Curve Signatures for Hash Chains as Post-Quantum Designs Move Toward Production
- Lido Opens Permissionless Ethereum Validators of Up to 2,048 ETH Behind a 32 ETH Operator Bond
- Miden Launches a Private-Finance Stack Built on a Confidential Circle Dollar as Privacy Layer 2s Court Institutions
Comments
0No comments yet.