Axelar and Secret Network Bridge Exploit: $4.67 Million "Infinite Mint" Vulnerability
On June 19, I recorded an incident in the cross-chain bridge between Axelar and the Secret Network protocol. The attacker, exploiting a critical vulnerability, withdrew approximately $4.67 million. The attack was based on an "infinite mint bug" — a classic but highly dangerous vector for cross-chain infrastructure.
The exploit remained undetected for seven days, indicating insufficient monitoring by the teams. According to my analysis, the vulnerability was found in the modified CW20-ICS20 contract on the Secret Network side, which was responsible for handling IBC connections in the Cosmos ecosystem. The problem was the lack of channel verification for incoming transactions. The contract created "wrapped" versions of assets (saToken) without verifying which channel the data came from.
The attacker launched their own Cosmos chain with a single validator, allowing them to emulate deposits and mint tokens without any real collateral. This enabled them to falsify asset denominations and withdraw funds. The Axelar Emergency Committee promptly disconnected the Secret and Secret-SNIP connections to prevent further unauthorized transfers. Coordination with exchanges and law enforcement agencies is currently underway to track and potentially recover the funds.
Scale and Consequences
The incident exclusively affected saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH coins. The main Axelar protocol, other IBC connections, and native assets of the Secret Network were not impacted. Nevertheless, this served as a warning signal for the market.
Interestingly, the price of the Secret (SCRT) token showed a short-term increase of nearly 6% following the news of the hack, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of approximately 3%. The market capitalization stands at about $20 million. However, it is worth noting that from its all-time high in October 2021 ($10.64), SCRT has fallen by 99.5%.
My Expert Commentary
This case once again highlights the systemic problem of cross-chain bridges: even a single error in channel verification can lead to multi-million dollar losses. The industry needs to transition to more robust architectures, such as zk-bridges or decentralized oracles with multi-level verification. The market, as usual, reacts irrationally — the rise in SCRT amid the hack likely indicates speculative interest rather than the fundamental resilience of the project.