Cross-chain bridge hack of Axelar and Secret Network: "infinite mint" vulnerability cost $4.67 million
On June 19, the blockchain infrastructure Axelar officially confirmed a security incident related to the bridge connecting its network with the Secret Network protocol. As a result of exploiting a critical vulnerability, the attacker withdrew assets worth approximately $4.67 million. A key feature of the attack was the use of the so-called "infinite mint" method, a technique allowing unlimited token creation without real backing.
According to data from the analytical team Common Prefix, which serves as the primary developer of Axelar, the breach was discovered in the ICS-20 smart contract on the Secret Network side, operating via an IBC connection in the Cosmos ecosystem. The contract was responsible for creating "wrapped" versions of assets (saToken) but did not verify which channel the incoming transaction originated from. This allowed the attacker to fabricate deposits and issue tokens without any backing.
The attack process required no permissions: the hacker launched their own chain in Cosmos with a single validator, from which they sent packets with fictitious asset denominations. Notably, the theft went unnoticed for seven days, indicating insufficient monitoring efficiency of bridge contracts.
The Axelar Emergency Committee promptly disconnected the Secret and Secret-SNIP connections to halt further unauthorized transfers. The team is coordinating with exchanges and law enforcement agencies to track funds and facilitate their recovery. The incident exclusively affected saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH coins. The main Axelar protocol, other IBC connections, and native assets of the Secret Network were not impacted.
Despite the theft report, the price of the Secret (SCRT) token reacted unexpectedly: the asset surged nearly 6% at one point, reaching $0.06. After a correction, SCRT is trading around $0.058, maintaining a daily gain of about 3%. The market capitalization stands at approximately $20 million. However, it is worth noting that at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current quotes—highlighting a deep decline in interest in the project.
My professional commentary: This incident is yet another reminder of the systemic risks of cross-chain bridges, especially those using modified contracts without proper channel verification. The "infinite mint" vulnerability remains one of the most dangerous for DeFi, and its exploitation for a week without detection underscores the need for implementing real-time automated audit systems. For investors, this is a signal: bridges should only be trusted after thorough verification of their architecture and security history.