Hassan Maishera
TL;DR
-
An attacker exploited a modified IBC bridge contract connecting Axelar to Secret Network to mint unbacked Secret-wrapped tokens.
-
The attacker redeemed them for roughly $4.67 million in real tokens, according to a postmortem from Common Prefix.
Flawed Token Contract Enabled Attacker to Mint Unbacked Assets
A security flaw in Secret Network's Axelar bridge integration allowed an attacker to steal approximately $4.67 million in crypto assets, and the exploit went undetected for 7 days before investigators uncovered the breach.
According to a postmortem released by blockchain security firm Common Prefix, the attacker exploited a vulnerability in a customized CW20-ICS20 token contract used to manage assets bridged from Axelar into Secret Network.
The contract was responsible for minting Secret-wrapped versions of Axelar assets, known as saTokens.
However, it failed to verify the origin channel of incoming transfers, enabling an attacker to create legitimate-looking tokens without depositing any collateral.
The exploit took advantage of the permissionless nature of the Inter-Blockchain Communication (IBC) protocol.
Investigators found that the attacker launched a single-validator Cosmos-based blockchain and established a direct IBC channel with the vulnerable bridge contract.
By sending forged transfer packets containing token denominations that matched approved assets, the attacker convinced the contract to mint saTokens despite no actual assets being deposited.
Because the contract validated token names but not the channel source, it could not distinguish fake deposits from legitimate transfers arriving through Axelar's authorized route.
After minting the fraudulent tokens, the attacker redeemed them through the legitimate Axelar bridge channel, allowing real assets held in escrow to be withdrawn.
Multiple Assets Targeted in the Attack
The exploit affected seven bridged assets:
-
saUSDT
-
saUSDC
-
saDAI
-
saWETH
-
saWBTC
-
saWBNB
-
sawstETH
According to Common Prefix, these assets were successfully redeemed for their underlying collateral, resulting in the multi-million-dollar drain.
The security flaw was not newly introduced. Investigators traced the bug back to the contract's original deployment in early 2023.
A subsequent contract migration on March 5, 2026, added new functionality but failed to address the missing source-validation checks.
The attacker ultimately exploited the vulnerable code on June 10. Secret Network later confirmed that the issue originated during modifications made to support Axelar integration.
The bridge design was altered from an escrow-based model to a mint-based model, and the functions responsible for validating transfer origins were removed in the process.
The Secret team also stated that no external audit was requested for the Axelar integration.
Encrypted Balances Delayed Detection
Unlike many public blockchains, Secret Network encrypts account balances by default.
As a result, the missing collateral was not immediately visible on-chain, making the exploit significantly harder to detect.
The shortfall only came to light on June 17 when a routine cross-chain transfer failed because the escrow account lacked sufficient funds to complete the transaction.
Investigators subsequently traced the discrepancy back to a series of withdrawals executed on June 10.
In its incident report, Secret Network argued that the bridge infrastructure lacked adequate monitoring systems capable of identifying suspicious activity before significant losses occurred.
The project stated that no anomaly detection systems, emergency pause mechanisms, or other safeguards were triggered despite the unusually large withdrawals.
Blockchain analysis conducted by Common Prefix shows the attacker moved the stolen assets through several ecosystems in an effort to obscure their trail.
The funds were first routed through Axelar and Osmosis using automated packet-forwarding mechanisms before being bridged to Ethereum.
Once on Ethereum, most of the assets were swapped for Ether through CoW Protocol. The attacker then split the proceeds across approximately 30 separate wallets before sending funds to deposit addresses associated with KuCoin, ChangeNow, and HitBTC.
Axelar and Secret Dispute Responsibility
Following discovery of the exploit, Axelar's emergency committee disabled connections to Secret Network and Secret-SNIP while investigations were underway. Cross-chain router Squid also removed Secret Network from its user interface.
Axelar maintains that its core protocol was never compromised and that no other chains, channels, or escrow accounts were affected.
"The exploited token smart contract was not developed, deployed, or maintained by Axelar," the team stated in a follow-up response, emphasizing that neither Axelar nor the underlying IBC protocol contained the vulnerability.
Secret Network, meanwhile, said it identified approximately $770,000 in stolen assets that remained traceable within the attacker's Axelar wallet.
According to the project, it requested that Axelar freeze or help recover those funds, but claimed the request was not acted upon.
Axelar has stated that it is coordinating with exchanges and law enforcement agencies and has not provided a timeline for restoring the disabled bridge connections.
At the time of publication, blockchain data indicated the attacker's Axelar wallet still held assets worth roughly $672,000, including:
-
6.2 WBTC
-
239,324 USDC
-
64.04 WBNB
-
248.85 AXL
Investigators continue to monitor the wallet as recovery efforts remain ongoing.
The Secret Network incident is the latest in a series of major bridge-related attacks in 2026.
In April, Kelp DAO suffered a significantly larger breach when an attacker exploited its LayerZero-based bridge, resulting in losses estimated at approximately $292 million in rsETH. The fallout from that incident extended into multiple DeFi protocols before community-led recovery efforts helped contain the damage.
The latest exploit highlights the continued security challenges facing cross-chain infrastructure, particularly as increasingly complex bridging mechanisms become critical to the broader blockchain ecosystem.
