Tools Crypto Exploit Tracker exploit-0033
Exploit record
Secret Network
- Loss
- $5M
- Attack vector
- Bridge Exploit
- Chain
- Secret Network
- Sector
- Bridge
What happened
Starting 10 June 2026, an attacker exploited an infinite-mint bug in Secret Network's Axelar bridge contract, draining about $4.67 million in Axelar-wrapped assets; the theft went unnoticed for seven days.
The deployed contract was a modified CW20-ICS20 fork with core security checks removed, so it did not verify the source channel of inbound IBC packets; the attacker spun up a single-validator Cosmos chain, self-relayed forged packets to mint unbacked saTokens, then redeemed them over the legitimate Axelar channel to drain real escrowed assets including saUSDT, saUSDC, saDAI, saWETH and saWBTC. The hole was discovered on 17 June when a failed transaction produced an insufficient-funds error, prompting investigation of the bridge's reserves.
Sources
- Common Prefix analysiswww.commonprefix.com/blog/secret-network-exploit
One record from the Crypto Exploit Tracker, maintained by the Security Desk. Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 15 September 2026