Axelar Bridge and Secret Network Hack: 'Infinite Mint' Vulnerability Cost $4.67 Million
On June 19, the blockchain project Axelar officially confirmed a hack of the cross-chain bridge connecting it to the Secret Network protocol. The attacker, exploiting a critical vulnerability in a smart contract, siphoned off approximately $4.67 million. Notably, the theft went undetected for a full seven days.
Attack Details: How the Bridge Was Compromised
Axelar's lead developer, Common Prefix, conducted a detailed analysis of the incident. It was found that the bug was located in a modified ICS-20 smart contract operating on the Secret Network side within the Cosmos IBC connection. The vulnerability stemmed from a lack of channel verification for incoming transactions. This allowed the attacker to forge deposits and mint "wrapped" assets (saTokens) without any real collateral.
To execute the attack, the attacker launched their own chain within the Cosmos ecosystem with a single validator. From this chain, they relayed packets with fake asset denominations, leading to unlimited token minting.
Response and Scale of Damage
Axelar's Emergency Committee promptly disabled the Secret and Secret-SNIP connections to halt further unauthorized transfers. The team is currently coordinating with exchanges and law enforcement agencies to track the stolen funds and explore potential recovery.
It is important to emphasize that the incident only affected the coins saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The core Axelar protocol, other IBC connections, and native assets of the Secret Network remained untouched.
Market Reaction and My Analysis
Despite the report of a major theft, the price of the native Secret token (SCRT) paradoxically surged nearly 6% momentarily, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of approximately 3%. The market capitalization stands at roughly $20 million.
It is worth noting that at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current levels.
My Expert Commentary: Attacks like these, based on the "infinite mint" vulnerability, are becoming increasingly sophisticated. The incident with Axelar and Secret Network is a stark example of how even a minor error in smart contract logic can lead to multi-million dollar losses. The rise in SCRT price amid the hack is more of a short-term speculative reaction than a sign of market confidence in the protocol's security. In the long term, such incidents undermine trust in cross-chain solutions and require development teams to conduct more thorough audits and implement mechanisms for automatic anomaly detection.