Secret Network Axelar Bridge Infinite-Mint Exploit

On June 10, 2026, the bridge linking Secret Network to Axelar was exploited for approximately $4.67 million. The attack went unnoticed for seven days, surfacing only on June 17 when a failed cross-chain transfer revealed that the Axelar escrow account backing the bridged assets had been emptied.

What happened

Secret Network's bridge contract minted Secret-wrapped versions of Axelar-bridged assets — known as saTokens — but did not verify which IBC channel an inbound transfer actually arrived on. The attacker spun up a single-validator Cosmos chain, opened a channel to the bridge contract, and self-relayed forged packets carrying token denominations that matched the contract's allow-list. Because the contract trusted the denom without checking the originating channel, it minted genuine saTokens with nothing backing them. The attacker then redeemed those unbacked tokens for roughly $4.67 million of real assets — a classic infinite-mint failure.

Aftermath

The stolen assets were withdrawn through Axelar, routed via Osmosis using automated packet-forwarding, bridged to Ethereum, and mostly swapped for ether on CoW Protocol. The proceeds were split across roughly 30 transfers to fresh wallets before landing in deposit addresses at KuCoin, ChangeNow, and HitBTC. Axelar's emergency committee disabled the Secret and Secret-SNIP connections once the drain was discovered, and the cross-chain router Squid removed Secret from its frontend. Axelar said its core protocol and other connections were unaffected — the loss was confined to the Secret Network bridge contract.

Why it matters

The Secret Network exploit is a textbook IBC trust-boundary failure: a bridge that validated what token was arriving but not where it came from let an attacker manufacture deposits from a chain they controlled. It echoes the same forged-message and mint-without-backing patterns seen in Gravity Bridge, Syscoin, and Verus. It also underlines a recurring detection gap — losses that hide for days because indexers and escrow balances are reconciled too slowly, the same monitoring blind spot that delayed discovery in several 2026 Cosmos-ecosystem incidents.