Axelar Bridge and Secret Network Hack: 'Infinite Mint' Vulnerability Cost $4.67 Million
On June 19, a serious incident in the cross-chain bridge ecosystem became known. An attacker exploited a vulnerability in the ICS-20 smart contract on the Secret Network side, allowing them to withdraw assets worth approximately $4.67 million. The attack, based on an "infinite mint" bug, went unnoticed for seven days, indicating an insufficient operational response from the project team.
As analysts determined, the bug was embedded in a modified version of the CW20-ICS20 contract responsible for interaction with the Cosmos IBC connection. The algorithm created "wrapped" versions of assets (saToken) but did not verify which channel the incoming transaction came from. This critical oversight allowed the attacker to falsify deposits and issue tokens without real backing.
Attack Details: How the Hacker Bypassed Security
Since the operations required no permission, the attacker launched a new Cosmos chain with a single validator. From this controlled network, they sent packets with fake asset denominations, which the contract on Secret Network accepted as real deposits. As a result, unbacked saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH were generated.
Axelar's Emergency Committee promptly disconnected the Secret and Secret-SNIP connections to stop further unauthorized transfers. The team is coordinating with exchanges and law enforcement agencies to track the funds and facilitate their recovery. It is important to note that the main Axelar protocol, other IBC connections, and native Secret Network assets are unaffected — the incident is localized.
Market Reaction: Paradoxical Rise of SCRT
Despite the news of the theft, the price of the Secret token (SCRT) momentarily surged nearly 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. The market capitalization stands at ~$20 million. This paradoxical rise is likely due to the market perceiving the incident as isolated and not threatening the underlying Secret Network protocol.
Meanwhile, at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current quotes. This clearly demonstrates how deeply the altcoin has fallen over the past few years and how even positive news cannot bring it back to its former heights.
Expert Commentary: This incident is yet another reminder that vulnerabilities in cross-chain bridges remain one of the industry's most acute problems. The "infinite mint" bug, which went undetected for a week, highlights the need for more frequent audits and the implementation of automated monitoring systems. As long as teams rely on manual detection, we will continue to see such attacks time and again.