Axelar Bridge and Secret Network Hack: 'Infinite Minting' Vulnerability Cost $4.67 Million
On June 19, the blockchain infrastructure Axelar faced a serious security incident: an attacker siphoned approximately $4.67 million through the bridge connecting the network to the Secret Network protocol. The attack went unnoticed for seven days, highlighting the complexity of monitoring cross-chain communications.
An analysis conducted by the Common Prefix team, Axelar's lead developer, revealed a vulnerability in the ICS-20 smart contract on the Secret Network side within the Cosmos IBC connection. The bug allowed the creation of "wrapped" versions of assets (saToken) without verifying the source of the incoming transaction. The attacker launched their own Cosmos chain with a single validator and sent packets with fictitious denominations, effectively using an "infinite mint" to issue unbacked tokens.
Axelar's Emergency Committee promptly disconnected the Secret and Secret-SNIP connections to prevent further unauthorized transfers. The team is coordinating efforts with exchanges and law enforcement agencies to track and recover the funds. Importantly, the incident only affected the coins saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The core Axelar protocol, other IBC connections, and native assets of the Secret Network remained untouched.
Despite the news of the theft, the price of the Secret token (SCRT) showed paradoxical dynamics: a brief surge of nearly 6% to $0.06, followed by a correction to $0.058. The daily increase was about 3%, with a market capitalization of approximately $20 million. However, investors should remember that from its all-time high in October 2021 ($10.64), SCRT has lost 99.5% of its value — a reminder of the high volatility and risks in the privacy blockchain sector.
Expert commentary: This incident is yet another alarming signal for the cross-chain ecosystem. The "infinite mint" vulnerability in IBC connections indicates that even mature protocols like Cosmos are not immune to errors in smart contract implementation. The market may be underestimating the systemic risks associated with wrapped assets: as long as bridges remain a weak link, trust in DeFi will be fragile.