Secret Network Bridge Exploited for $4.7 Million with 'Infinite Mint' Bug

A critical smart contract bridging Secret Network and Axelar was exploited due to an 'infinite mint' vulnerability, resulting in a loss of approximately $4.67 million. This significant security breach within the cryptocurrency ecosystem occurred during the transfer of assets from Secret Network to the Axelar chain and remained undetected for seven days. The incident, which began on June 10, was only discovered on June 17 after a failed cross-chain transfer revealed insufficient funds in Axelar's escrow account.

According to a detailed post-mortem by blockchain research firm Common Prefix, the vulnerability stemmed from a modified CW20-ICS20 smart contract on the Secret Network side of the Cosmos Inter-Blockchain Communication (IBC) connection. This contract, when adapted from an escrow model to a minting model for the Axelar integration, had two key functions responsible for verifying the origin of transfers removed, thereby weakening its security. The attacker leveraged this flaw to mint unbacked Secret-wrapped tokens (saTokens). During the exploit, the attacker was identified to have spun up a new Cosmos chain with a single validator, from which they sent packets with fake asset denominations, effectively creating unauthorized Secret-wrapped Axelar tokens.

The stolen funds were subsequently routed through Osmosis to the Ethereum network, swapped for Ether (ETH) on CoW Protocol, and then dispersed to centralized cryptocurrency exchanges including KuCoin, ChangeNow, and HitBTC. Secret Network requested Axelar to freeze an address holding approximately $672,000 (or $770,000 as per some sources) of the stolen funds in an Axelar wallet. However, Axelar denied this request, stating that its core protocol was unaffected and the exploited contract was not developed or maintained by them. This situation has created a complex scenario regarding accountability and fund recovery.

Despite the theft, the broader cryptocurrency markets did not experience widespread panic. Following the disclosure, Secret Network's native token, SCRT, saw a brief surge of nearly 6%, while Axelar's AXL token also rose by approximately 1.3%. This suggests that the markets viewed the incident as an isolated security breach, with Axelar's core protocol remaining uncompromised helping to maintain investor confidence. Nevertheless, the recurrence of such bridge exploits continues to raise concerns about the overall reliability of the DeFi ecosystem.

In a broader context, these types of cross-chain bridge exploits are a stark reminder of the persistent security challenges within the decentralized finance (DeFi) space. Previous large-scale bridge attacks, such as those on Wormhole and Ronin Network, underscore the critical nature of these vulnerabilities. The privacy-focused design of Secret Network, which encrypts transaction details, may have contributed to the exploit remaining undetected for seven days. Furthermore, the fact that the exploited contract had not undergone an external audit since its deployment in early 2023 highlights the potential risks associated with a lack of rigorous security assessments.

Market analysts emphasize the need for more stringent audits of cross-chain solutions and smart contracts following such incidents. Moving forward, bridge protocols are expected to develop more robust monitoring mechanisms and emergency response plans. Axelar's emergency committee promptly disabled the Secret and Secret-SNIP connections to prevent further losses and stated they are coordinating with relevant exchanges and law enforcement agencies to track and recover the funds. These events consistently demonstrate that the security of bridges between crypto assets is of paramount importance for the entire ecosystem.