Axelar and Secret Network Bridge Hack: Critical Vulnerability of $4.67 Million Discovered
On June 19, as an analyst at Cryptalist, I recorded a serious incident in the field of cross-chain bridges. The Axelar project officially confirmed a hack of its bridge connecting to the Secret Network protocol. The attacker, exploiting an "infinite mint" vulnerability, withdrew approximately $4.67 million. Notably, the attack went unnoticed for seven days, indicating insufficient monitoring responsiveness.
Details of the Bug Exploitation
An analysis of the incident conducted by the Common Prefix development team identified the root cause. The vulnerability was found in the ICS-20 smart contract on the Secret Network side within the Cosmos IBC connection. The contract, responsible for creating "wrapped" versions of assets (saToken), did not verify the incoming transaction channel. This allowed the attacker to falsify deposits and mint unbacked tokens.
To execute the attack, the attacker launched their own Cosmos chain with just one validator. From this controlled network, they sent packets with fictitious asset amounts, which the Secret Network contract accepted as legitimate deposits. As a result, saTokens were generated without real backing.
Response and Scale of Damage
The Axelar Emergency Committee immediately disabled the Secret and Secret-SNIP connections to prevent further unauthorized transfers. The team is coordinating with exchanges and law enforcement agencies to track and recover funds. It is important to emphasize that the incident is limited to saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH coins. The main Axelar protocol, other IBC connections, and native assets of the Secret Network were not affected.
Market Reaction
Despite the severity of the hack, the market reacted ambiguously. The price of the Secret token (SCRT) briefly surged nearly 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of approximately 3%. The market capitalization stands at about $20 million. However, it is worth noting that at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% higher than current quotes. This demonstrates how deeply the project is in a bearish phase, and such incidents only undermine confidence in its infrastructure.
My professional opinion: This incident is another reminder of the fundamental risks associated with cross-chain bridges. The "infinite mint" vulnerability is classic for immature IBC implementations. Despite assurances of security, the market has already learned to punish projects for such mistakes. Long-term restoration of trust in Axelar and Secret Network will require not only technical audits but also a fundamental overhaul of security procedures.