Axelar and Secret Network Bridge Hack: Hacker Steals $4.67 Million Through 'Infinite Minting' Vulnerability
On June 19, the Axelar blockchain infrastructure officially confirmed a hack of the cross-chain bridge connecting its network to the Secret Network protocol. As a result of the attack, the attacker withdrew digital assets worth approximately $4.67 million by exploiting a critical vulnerability known as "infinite mint."
The incident went unnoticed for seven days, highlighting the complexity of monitoring cross-network transactions. Axelar's lead developer, the Common Prefix team, conducted a detailed analysis and found that the bug was located in the ICS-20 smart contract on the Secret Network side, operating within the Cosmos IBC connection. The contract was responsible for creating "wrapped" versions of assets (saToken) but did not verify which channel an incoming transaction originated from. This allowed the attacker to fabricate deposits and issue tokens without real backing.
Since operations on the Cosmos network do not require permission, the hacker launched their own chain with a single validator and began sending packets with fictitious asset denominations. Thus, they were able to mint arbitrary amounts of wrapped Axelar assets on the Secret Network.
Axelar's Emergency Committee promptly disabled the Secret and Secret-SNIP connections to halt further unauthorized transfers. The team is currently coordinating with exchanges and law enforcement agencies to track the stolen funds and facilitate their recovery. It is important to note that the incident only affected saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH coins. The main Axelar protocol, other IBC connections, and native Secret Network assets remained untouched.
Despite such a serious event, the price of the Secret Network native token (SCRT) showed unexpected growth. At one point, the asset surged nearly 6%, reaching $0.06. After a correction, SCRT is trading around $0.058, maintaining a daily increase of about 3%. The market capitalization stands at approximately $20 million. For context, at its all-time high in October 2021, SCRT was worth $10.64, which is 99.5% above current levels.
Expert opinion: This hack is yet another reminder that cross-chain bridges remain the most vulnerable element of DeFi infrastructure. The "infinite mint" vulnerability in ICS-20 contracts is a classic example of insufficient validation of incoming data. The market's paradoxical reaction to the rise in SCRT after the news of the theft is likely related to the temporary removal of uncertainty and faith in the team's ability to handle the consequences. However, investors should remember that restoring trust after such incidents is a long and difficult process.