On June 19, blockchain project Axelar disclosed a breach of its bridge with the Secret Network protocol. The attacker exploited a vulnerability known as the “infinite mint” to siphon approximately $4.67 million.
We analyzed the Secret Network incident. An attacker exploited an infinite-mint bug in a modified CW20-ICS20 token contract on Secret to drain ≈$4.67M. The attacker minted arbitrary Secret-wrapped Axelar assets on Secret by spinning up a new Cosmos chain with 1 validator and… https://t.co/itCkRXjkkp
— Common Prefix (@CommonPrefix) June 19, 2026
The theft went unnoticed for seven days.
According to Axelar’s lead developer, Common Prefix, the bug was found in the ICS-20 smart contract on the Secret side of the Cosmos IBC connection. The algorithm created “wrapped” versions of assets (saToken) but did not verify the channel from which the incoming transaction originated. This allowed the attacker to fake deposits and issue tokens without backing.
Since the operations did not require permission, the attacker launched a Cosmos chain with a single validator, from which they sent packets with fake asset denominations.
Axelar’s emergency committee disabled the Secret and Secret-SNIP connections to stop further unauthorized transfers. The team is coordinating with exchanges and law enforcement to track the funds and assist in their recovery.
The statement noted that the incident was limited to the coins saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. The main Axelar protocol, other IBC connections, and native Secret Network assets were unaffected.
Despite the theft report, the price of the Secret token (SCRT) briefly surged nearly 6% to $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. Its market capitalization is approximately $20 million.
At its historical peak in October 2021, SCRT was valued at $10.64, which is 99.5% higher than current prices.
Earlier in June, hackers twice attacked outdated contracts in the L2 network Aztec, causing damages of $2.19 million and $2.15 million.
