Secret Network Axelar Bridge Exploit Drains $4.67 Million After Going Undetected for Seven Days

A vulnerability in Secret Network’s Axelar bridge integration allowed an attacker to steal approximately $4.67 million in digital assets, with the exploit remaining unnoticed for a full week before being discovered.

The attack took place on June 10 and targeted a modified bridge contract responsible for handling assets transferred from Axelar to Secret Network. According to a post incident analysis, the flaw enabled the attacker to mint unbacked Secret wrapped tokens and later redeem them for real assets held in escrow.

How the Infinite-Mint Exploit Worked

Investigators found that the contract failed to verify the source of incoming transfers. Taking advantage of this weakness, the attacker created a single-validator Cosmos chain and opened a connection to the vulnerable contract. This allowed forged transfer packets to appear legitimate, resulting in the minting of unsupported tokens.

The stolen assets included saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB and sawstETH.

Exploit Traced to Older Contract Design

Researchers said the vulnerability dated back to the contract’s original deployment in early 2023 and remained after a March 2025 code migration. The missing collateral was only discovered on June 17 when a routine cross-chain transaction failed because the escrow account lacked sufficient funds.

Axelar disabled Secret-related connections after the discovery and stated that its core protocol and other chains were not affected. Secret Network said around $770,000 of the stolen assets were identified as potentially recoverable, while blockchain data later showed roughly $672,000 remained in the attacker’s Axelar wallet. Authorities and exchanges are now assisting with recovery efforts.