Exploit of the Axelar and Secret Network bridge: the "infinite minting" vulnerability cost $4.67 million
On June 19, blockchain infrastructure Axelar confirmed a hack of the cross-chain bridge connecting to the Secret Network protocol. As a result of the attack, the attacker managed to withdraw assets worth approximately $4.67 million by exploiting a critical vulnerability known as "infinite mint."
Notably, the theft went unnoticed for seven days. This highlights the complexity of monitoring cross-network transactions and the need to implement more advanced early anomaly detection systems.
Attack Mechanics: Channel Spoofing and Fake Deposits
As analysis by the Common Prefix development team showed, the bug was embedded in the ICS-20 smart contract on the Secret Network side, operating within the Cosmos ecosystem via an IBC connection. The main issue was the lack of validation of the incoming channel: the contract created "wrapped" versions of assets (saToken) without checking which channel the transaction came from.
This allowed the attacker to fabricate deposits. They launched their own Cosmos chain with a single validator and began sending packets with false asset denominations. Since the operation required no permission, the attacker could mint tokens indefinitely without any real collateral.
Reaction and Consequences
Axelar's Emergency Committee promptly disabled the Secret and Secret-SNIP connections to block further unauthorized transfers. The team is coordinating with exchanges and law enforcement agencies to track and potentially recover the funds.
It is important to emphasize: the incident only affected specific coins — saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The main Axelar protocol, other IBC connections, and native Secret Network assets remained untouched.
Market Reaction: Paradoxical Growth
Despite the news of the theft, the price of the native Secret token (SCRT) unexpectedly rose by nearly 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. The market capitalization stands at approximately $20 million.
However, it is worth noting that SCRT is 99.5% below its all-time high from October 2021 ($10.64). The current growth is likely a short-term bounce amid oversold conditions or speculation, rather than a sign of fundamental recovery.
Expert Opinion: This incident is yet another reminder that vulnerabilities in cross-chain bridge smart contracts remain one of the most dangerous threats to the DeFi ecosystem. The lack of incoming packet channel validation is a gross design-stage error that could have been identified with more thorough auditing. Although the market reacted with a rise in SCRT, in the long term, it may face a loss of trust in bridge solutions if such bugs are not addressed at the systemic level.