Axelar Bridge and Secret Network Hack: 'Infinite Mint' Vulnerability Costs $4.67 Million
On June 19, the blockchain project Axelar officially confirmed a hack of the cross-chain bridge connecting it to the Secret Network protocol. The attacker, exploiting an "infinite mint" vulnerability, withdrew approximately $4.67 million in wrapped assets. The incident went unnoticed for seven days, indicating an insufficient level of transaction monitoring on the Secret Network side.
Attack Details and Technical Background
According to Axelar's lead developer, Common Prefix, the bug was discovered in the ICS-20 smart contract deployed on Secret Network as part of the Cosmos IBC connection. The issue was that the contract, which creates "wrapped" versions of assets (saToken), did not verify the origin channel of incoming transactions. This allowed the attacker to falsify deposits and mint tokens without real backing.
To execute the attack, the attacker launched a new chain with a single validator within the Cosmos ecosystem. From this chain, they sent packets with fake asset denominations, leading to the issuance of unbacked saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The operations required no permission, making the vulnerability easily exploitable.
Reaction and Market Consequences
Axelar's emergency committee promptly disabled the Secret and Secret-SNIP connections to halt further unauthorized transfers. The team is coordinating with exchanges and law enforcement agencies to track the funds and potentially recover them. It is important to emphasize that the main Axelar protocol, other IBC connections, and native Secret Network assets were not affected.
Despite the hack report, the price of the Secret token (SCRT) briefly surged nearly 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. The market capitalization stands at approximately $20 million. Meanwhile, at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current quotes.
Expert Opinion
This incident is yet another alarming signal for the entire cross-chain bridge industry. Vulnerabilities like the "infinite mint" are becoming classics, but projects continue to ignore basic channel checks and smart contract audits. As long as bridges remain the weak link in DeFi, investors should expect similar attacks to recur, especially on less liquid networks where security monitoring leaves much to be desired.