Axelar disclosed a bridge hack with Secret Network: the hacker stole $4.67 million through an "infinite minting" vulnerability
On June 19, the blockchain infrastructure project Axelar officially confirmed the hack of the cross-chain bridge connecting its ecosystem with the Secret Network protocol. The attacker managed to withdraw assets worth approximately $4.67 million by exploiting a critical smart contract error known as an "infinite mint."
The theft went unnoticed for seven days — an alarming signal for the entire industry, demonstrating how vulnerable even seemingly verified cross-chain bridges can be.
How the Attack Was Carried Out
According to an analysis conducted by the Common Prefix team — Axelar's primary developer — the breach was found in a modified ICS-20 contract deployed on the Secret Network side as part of the Cosmos IBC connection. The issue was that the algorithm creating "wrapped" versions of assets (saToken) did not verify the channel from which the incoming transaction originated.
This allowed the hacker to fake deposits and trigger token minting without any collateral. To execute the attack, they deployed their own Cosmos chain with a single validator, from which they sent packets with fake asset denominations.
Scale and Consequences
Axelar's Emergency Committee immediately disabled the Secret and Secret-SNIP connections to prevent further unauthorized transfers. The team is currently coordinating with exchanges and law enforcement agencies to track the stolen funds and explore their possible recovery.
It is important to emphasize: the incident exclusively affected saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH coins. The main Axelar protocol, other IBC connections, and native Secret Network assets remained untouched.
Market Reaction
Despite the severity of the incident, the price of the Secret token (SCRT) showed a paradoxical reaction — it surged nearly 6% at one point, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. The current market capitalization stands at approximately $20 million.
For context: at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current quotes. This fact vividly illustrates how deeply the market had already discounted risks associated with the project even before this hack.
Expert comment from Cryptalist: This incident is yet another reminder that cross-chain bridge security remains the "Achilles' heel" of the entire DeFi ecosystem. The "infinite mint" vulnerability is not an exotic bug but a classic error in verification logic that we have seen multiple times before. Until teams implement multi-layered channel checks and real-time automated anomaly monitoring systems, such attacks will continue. For investors, this is a signal: asset diversification is not a panacea if the bridge through which they pass is unreliable.