#TradFi Trading Strategies Sharing Challenge #World Cup Predictions: 100,000 USDT Daily #BTC Prophet: 20-Day 380 Million HTX Challenge Secret Network's Axelar Bridge Drained $4.67M via Infinite-Mint FlawSecret Network's cross-chain bridge to Axelar has been suspended after an attacker exploited a years-old minting flaw to drain $4.67 million in wrapped tokens over seven undetected days.
Both teams disclosed the incident on June 19, confirming approximately $4.67 million in assets were taken from the bridge's Axelar-to-Secret IBC connection. The attack itself began on June 10 but went unnoticed for seven days until a routine cross-chain transfer failed because the bridge's escrow account had been depleted.
Minting Flaw
The vulnerability lived in a modified CW20-ICS20 smart contract deployed on Secret Network for the Axelar bridge connection. Security research firm Common Prefix published a technical breakdown of the incident, finding that two critical validation checks had been commented out from the contract's packet-receive function: one that should have verified incoming token denominations against the legitimate source channel, and one that should have capped outflows to amounts genuinely held in escrow.
The flaw dates to the contract's initial deployment in March 2023 and survived a migration on March 5, 2026 that updated the bytecode for new features but preserved the missing checks. Secret Network's default transaction encryption obscured the growing shortfall from on-chain observers; the attack ran for seven days before a failed transfer surfaced it.
To exploit the gap, the attacker spun up a single-validator Cosmos SDK chain and opened a new IBC channel to Secret Network. IBC channel creation is permissionless by design, meaning any chain can initiate a connection. The attacker self-relayed forged IBC packets carrying bare denominations that matched the bridge's allow-list. With both validation checks missing, the contract minted unbacked wrapped tokens
All Comments0LatestHot