Exploit of the Axelar and Secret Network Bridge: "Infinite Minting" Vulnerability Led to $4.67 Million Loss
On June 19, I recorded a serious security incident on the cross-chain bridge between Axelar and Secret Network. As a result of the exploitation of a critical vulnerability, the attacker withdrew assets worth approximately $4.67 million. The attack went unnoticed for seven days, indicating insufficient responsiveness of the monitoring systems.
During the analysis conducted by the Common Prefix team (the main developer of Axelar), it was determined that the breach was in the ICS-20 smart contract on the Secret Network side, operating over an IBC connection in the Cosmos ecosystem. The problem was the lack of verification of the channel from which the incoming transaction originated. The contract created "wrapped" versions of assets (saToken) without verifying the source of the deposit. This allowed the attacker to fabricate deposits and initiate a process of "infinite minting" — issuing tokens without real backing.
The attacker launched their own Cosmos chain with a single validator, from which they sent packets with fake asset denominations. Since the protocol did not require permission for such operations, they were able to manipulate balances without hindrance. The Axelar Emergency Committee promptly disconnected the Secret and Secret-SNIP connections to stop further unauthorized transfers. The team is now coordinating with exchanges and law enforcement agencies to track and recover the funds.
It is important to emphasize that the incident only affected the coins saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The main Axelar protocol, other IBC connections, and native assets of Secret Network remained untouched. This indicates the targeted nature of the attack, rather than a systemic failure.
Despite the news of the theft, the price of the Secret token (SCRT) paradoxically rose by almost 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily increase of about 3%. The market capitalization is approximately $20 million. For comparison, at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current levels. Such a market reaction may be explained by temporary demand amid expectations of recovery, but I believe investors should remain cautious — vulnerabilities in cross-chain infrastructure remain a serious risk for the project's long-term stability.
My analysis: This case once again highlights that the architecture of IBC-based bridges, despite their decentralization, requires thorough auditing of contract logic on the receiving network side. The channel verification error is a classic but dangerous vulnerability that attackers will exploit until developers implement stricter validation mechanisms. Investors should consider that such incidents may recur, and asset diversification remains a key protection strategy.