Axelar Bridge and Secret Network Hack: 'Infinite Mint' Vulnerability Cost $4.67 Million
On June 19, the blockchain infrastructure project Axelar confirmed the exploitation of a critical vulnerability in the bridge connecting its network with the privacy protocol Secret Network. As a result of the attack, the attacker managed to withdraw assets worth approximately $4.67 million. The incident went unnoticed for seven days, indicating the difficulty of detecting such attacks in cross-chain infrastructure.
According to an analysis conducted by the Common Prefix team, the primary developer of Axelar, the exploit was carried out through a modified ICS-20 smart contract on the Secret Network side, operating within an IBC connection with Cosmos. The bug involved the lack of verification of the channel from which the incoming transaction originated. This allowed the attacker to falsify deposits and initiate a process of "infinite minting" — issuing "wrapped" versions of assets (saToken) without real backing.
The attacker deployed their own chain with a single validator in Cosmos, from which they sent packets with fictitious denominations. Since the operation did not require permission, this allowed them to generate unbacked tokens until the vulnerability was discovered.
Axelar's Emergency Committee immediately disconnected the Secret and Secret-SNIP connections to block further unauthorized transfers. The team is already coordinating with exchanges and law enforcement agencies to track the stolen funds and facilitate their recovery.
It is important to note that the incident only affected specific assets: saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The core Axelar protocol, other IBC connections, and native assets of Secret Network remained untouched.
Despite the report of the theft, the market reacted paradoxically: the price of the SCRT token briefly surged nearly 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. The project's market capitalization stands at approximately $20 million. For comparison, at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current quotes.
Expert Commentary
This case once again highlights the fundamental security issue of cross-chain bridges: even when using standardized protocols such as IBC, insufficient verification of incoming data on the receiving network side can lead to catastrophic consequences. The industry needs to implement stricter smart contract audit mechanisms and multi-layered channel verification systems to prevent the recurrence of such attacks in the future.