Axelar cross-chain bridge attacked: $4.67 million loss due to "infinite mint" vulnerability
On June 19, 2026, an incident occurred involving a cross-chain bridge connecting the Axelar blockchain project and the Secret Network protocol. During the attack, the perpetrator withdrew approximately $4.67 million by exploiting a critical vulnerability in a smart contract. Notably, the theft went undetected for seven days.
As the team at lead developer Common Prefix discovered, the bug was found in a modified CW20-ICS20 contract on the Secret Network side within the Cosmos IBC connection. The vulnerability allowed the creation of "wrapped" versions of assets (saToken) without verifying the source of the incoming transaction. The attacker fabricated deposits by launching a new chain in Cosmos with a single validator and sending packets with fictitious denominations from it.
Axelar's Emergency Committee promptly disconnected the Secret and Secret-SNIP connections to prevent further unauthorized transfers. The team is currently coordinating with exchanges and law enforcement agencies to track the funds and potentially recover them.
According to the statement, the incident is limited to saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH coins. The main Axelar protocol, other IBC connections, and native assets of Secret Network remained untouched.
Despite the news of the hack, the price of the Secret token (SCRT) surged nearly 6% at one point, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily increase of about 3%. The market capitalization stands at approximately $20 million. For comparison, at its all-time high in October 2021, SCRT was worth $10.64 — 99.5% above current quotes.
Analytical commentary: This incident is yet another alarming signal for the entire cross-chain bridge ecosystem. Vulnerabilities of the "infinite mint" type are becoming classic, and their exploitation points to insufficient audit security of IBC connections. While the market currently perceives the attack as localized, the SCRT price is unlikely to hold at current levels without confident steps to recover funds and strengthen security.