Axelar Bridge and Secret Network Hack: 'Infinite Mint' Vulnerability Leads to $4.67 Million Loss
On June 19, the blockchain project Axelar officially confirmed a hack of the cross-chain bridge connecting it to the Secret Network protocol. The attacker managed to withdraw assets worth approximately $4.67 million by exploiting a critical vulnerability known as an "infinite-mint bug." The incident went unnoticed for seven days, indicating insufficient security monitoring responsiveness on the part of Secret Network.
How the Hack Occurred
According to an analysis by Axelar's lead developer team, Common Prefix, the vulnerability was embedded in a modified CW20-ICS20 smart contract on the Secret Network side. This contract was responsible for creating "wrapped" versions of assets (saToken) within the Cosmos ecosystem via an IBC connection. The problem lay in the lack of verification of the channel from which the incoming transaction originated. The attacker launched their own Cosmos chain with a single validator and began sending packets with fake asset denominations. The protocol, lacking a verification mechanism, unconditionally minted tokens without real backing.
Scale and Consequences
The Axelar Emergency Committee promptly disconnected the Secret and Secret-SNIP connections to block further unauthorized transfers. Currently, the team is coordinating with exchanges and law enforcement agencies to track the stolen funds and potentially recover them. It is important to emphasize that the incident only affected specific coins: saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The core Axelar protocol, other IBC connections, and native assets of Secret Network were not compromised.
Market Reaction
Despite the shocking news, the market reacted ambiguously. The price of the Secret token (SCRT) briefly surged nearly 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. The market capitalization stands at approximately $20 million. However, it is worth noting that current quotes are 99.5% below the all-time high of $10.64 recorded in October 2021. This indicates a deep bearish trend for SCRT, despite short-term volatility.
This incident serves as yet another reminder that cross-chain bridges remain one of the most vulnerable points in the DeFi ecosystem. The absence of strict input channel checks can lead to catastrophic consequences, as happened with Axelar and Secret Network. In my professional opinion, projects need to implement multi-layered verification systems and automatic triggers to block suspicious transactions in real time; otherwise, such attacks will become routine.