Axelar Bridge and Secret Network Hack: Infinite Minting Vulnerability Costs $4.67 Million
On June 19, blockchain infrastructure project Axelar officially confirmed a hack of the cross-chain bridge connecting its network to Secret Network. The attacker exploited a critical vulnerability known as an "infinite-mint bug" and withdrew assets worth approximately $4.67 million. The theft went unnoticed for seven days, indicating shortcomings in monitoring systems.
Attack Details: Channel Spoofing and Fake Deposits
According to an analysis conducted by Axelar's lead developer team, Common Prefix, the bug was found in the ICS-20 smart contract deployed on the Secret Network side as part of the IBC connection within the Cosmos ecosystem. The issue was that the algorithm creating "wrapped" versions of assets (saToken) did not verify which specific channel an incoming transaction originated from. This allowed the attacker to fabricate deposits and trigger the process of unbacked token issuance.
To execute the attack, the attacker launched their own chain in Cosmos with a single validator. From this controlled network, they sent packets with fake asset denominations, which the bridge perceived as legitimate. Thus, the hacker gained the ability to mint an arbitrary amount of wrapped Axelar assets on the Secret Network platform without real backing.
Scale and Consequences
Axelar's Emergency Committee promptly disabled the Secret and Secret-SNIP connections to halt further unauthorized transfers. The team is currently coordinating with exchanges and law enforcement agencies to track the stolen funds and explore potential recovery.
It is important to emphasize that the incident affected only a limited pool of coins: saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The core Axelar protocol, other IBC connections, and native Secret Network assets remained untouched. This indicates that the vulnerability was localized to a specific smart contract, not the underlying infrastructure.
Market Reacts Oddly: SCRT Rises Amid Hack
Despite the report of the theft, the price of Secret Network's native token (SCRT) showed unexpected growth. At one point, the asset surged nearly 6%, reaching $0.06. After a slight correction, SCRT is trading around $0.058, maintaining a daily gain of about 3%. The market capitalization stands at approximately $20 million.
This market reaction may be due to investors perceiving the team's swift actions to isolate the problem as a positive signal. However, it is worth noting that current prices are 99.5% below the all-time high of $10.64 recorded in October 2021. This underscores a deep bearish trend for the asset, despite short-term spikes.
Expert Analysis
This incident serves as another reminder that cross-chain bridges remain the most vulnerable point in the DeFi ecosystem. The "infinite mint" vulnerability is a classic error in channel verification logic that could have been identified during the audit stage. The market clearly underestimates the risks associated with IBC connections, and the SCRT price reaction appears more emotional than rational. Against the backdrop of recent attacks on outdated contracts in the Aztec network (losses of $2.19 million and $2.15 million), this case confirms that bridge security requires a fundamental reassessment of priorities by developers.