Axelar and Secret Network cross-chain bridge hacked for $4.67 million: 'infinite mint' vulnerability exposed
On June 19, 2026, the blockchain infrastructure project Axelar officially confirmed a critical hack of the bridge connecting it to the Secret Network protocol. The damage from the attack amounted to approximately $4.67 million. The attacker exploited an "infinite mint" vulnerability, allowing them to generate unbacked assets. Notably, the theft went unnoticed for seven days, indicating an insufficient level of on-chain transaction monitoring on the Secret Network side.
Technical Details of the Exploit
According to an analysis by Axelar's lead developer, Common Prefix, the bug was embedded in the ICS-20 smart contract, modified to the CW20-ICS20 standard on the Secret Network side. This contract was responsible for creating "wrapped" versions of assets (saToken) within the Cosmos IBC connection. However, the critical error was the lack of verification of the channel from which the incoming transaction originated. The attacker exploited this: they launched their own Cosmos chain with a single validator and sent packets with fake asset denominations. The system, without verifying the source, uncontrollably minted saToken without real backing. This is a classic example of a cross-chain bridge vulnerability, where trust in the channel outweighs state verification.
Scale and Response
The Axelar Emergency Committee promptly disabled the Secret and Secret-SNIP connections to prevent further unauthorized transfers. The incident exclusively affected the coins saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The main Axelar protocol, other IBC connections, and native Secret Network assets remained untouched. The team is already coordinating with exchanges and law enforcement agencies to track and recover the stolen funds. This demonstrates that even with a localized hack, reputational risks for the entire cross-chain sector remain high.
Market Reaction: Paradoxical Rise of SCRT
Despite the shocking news, the price of the Secret token (SCRT) showed an anomalous increase. At one point, the asset surged nearly 6%, reaching $0.06. After a correction, SCRT is trading around $0.058, maintaining a daily gain of about 3%. The project's market capitalization is approximately $20 million. This market behavior may be explained by a speculative rebound amid news of localized damage and the absence of a threat to the main protocol. However, it is worth recalling that SCRT's all-time high was recorded in October 2021 at $10.64 — current quotes are 99.5% lower. This underscores a deep bearish phase for the asset.
Expert Opinion
This incident is yet another reminder of the systemic vulnerability of cross-chain bridges, especially in the Cosmos ecosystem, where IBC connections often rely on trust in the channel rather than cryptographic verification. Projects need to implement multi-layered checks for incoming transactions and conduct smart contract audits with a focus on source validation. The market, judging by SCRT's reaction, is not yet ready to penalize such incidents, but the long-term consequences for trust in bridges could be devastating.