Axelar and Secret Network Bridge Hack: Hacker Steals $4.67 Million via 'Infinite Mint' Vulnerability
On June 19, the blockchain project Axelar officially confirmed a hack of the cross-chain bridge connecting it to the Secret Network protocol. The attacker managed to withdraw assets worth approximately $4.67 million by exploiting a critical vulnerability known as "infinite mint." Notably, the theft went unnoticed for seven days, highlighting insufficient monitoring responsiveness within the ecosystem.
Attack Mechanism: How the Hacker Bypassed Security
As determined by the Common Prefix development team, the bug was embedded in the ICS-20 smart contract deployed on the Secret Network side as part of the Cosmos IBC connection. This contract was responsible for creating "wrapped" versions of assets (saToken) but did not verify which channel the incoming transaction originated from. This negligence in validation allowed the attacker to fabricate deposits and mint tokens without real backing.
To execute the attack, the hacker launched their own chain in Cosmos with a single validator, from which they sent packets with fake asset denominations. Since the operations required no permission, they were able to mint tokens uncontrollably and then withdraw them through the bridge.
Axelar's Response and Scope of Consequences
Axelar's emergency committee promptly disabled the Secret and Secret-SNIP connections to halt further unauthorized transfers. The team is currently coordinating with exchanges and law enforcement agencies to track the stolen funds and explore potential recovery.
It is important to emphasize that the incident only affected the coins saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The main Axelar protocol, other IBC connections, and native assets of the Secret Network remained untouched. This limits the damage but does not eliminate concerns about the overall security of cross-chain infrastructure.
Market Not Panicking: Paradoxical SCRT Growth
Despite the news of the hack, the price of the Secret token (SCRT) briefly surged nearly 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. The market capitalization stands at approximately $20 million. For comparison, at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current quotes. The market appears to have perceived the incident as localized and not threatening the project's fundamental metrics.
Analyst's Opinion
This case once again demonstrates that "infinite mint" vulnerabilities remain one of the most dangerous threats to cross-chain bridges. The lack of verification of the source of incoming transactions is a gross error that could have been prevented during the audit stage. Investors should be more cautious with projects using modified contract standards and demand public security reports.