Secret Network has disclosed a security incident that resulted in the loss of approximately $4.67 million after an attacker exploited a flaw in a bridge-related smart contract. The exploit enabled the creation of unbacked wrapped assets that were later exchanged for real assets held in escrow.
The issue remained hidden for seven days before being detected on June 17, when a failed cross-chain transaction generated an insufficient funds error, prompting further investigation into the bridge’s reserves.
How the Exploit Worked?
According to blockchain security researchers at Common Prefix, the vulnerability existed in a modified CW20 ICS20 token contract on the Secret Network side of the Cosmos ecosystem.
The contract was responsible for minting Secret wrapped versions of Axelar bridged assets, commonly known as saTokens. However, the contract failed to verify the source channel of incoming transfers before minting new tokens.
This oversight allowed the attacker to forge deposits and create legitimate-looking saTokens without depositing any real assets as collateral.
Researchers explained that the attacker launched a Cosmos chain with a single validator and used it to send packets containing fake asset denominations. Because the contract did not properly validate the source of these messages, it minted genuine saTokens backed by nothing.
Once the fraudulent tokens were created, the attacker redeemed them through legitimate Axelar channels, draining real assets held in escrow.
Assets Affected and Fund Movements
The exploit impacted several Axelar wrapped assets on Secret Network, including:
- saUSDT
- saUSDC
- saDAI
- saWETH
- saWBTC
- saWBNB
- sawstETH
After obtaining the assets, the attacker bridged them to Ethereum and converted the funds into Ether (ETH).
Blockchain analysis showed that the stolen funds were distributed across roughly 30 wallets, likely in an effort to obscure their origin. Some of the funds were later transferred to cryptocurrency platforms, including KuCoin, ChangeNow, and HitBTC.
Emergency Response From Secret Network and Axelar
Following the discovery, Secret Network warned users that affected Axelar bridged saTokens may no longer be fully backed and that holders could face losses.
The network clarified that its native SCRT token was not affected by the exploit.
Axelar also issued a statement after reports of the breach created confusion within the community.
The team stated:
“Neither Axelar nor IBC was compromised. The exploited token smart contract was not developed, deployed, or maintained by Axelar. Axelar’s firewalling prevented the impact from spreading to other chains.
Axelar
Axelar’s emergency committee reportedly disabled the Secret and Secret SNIP connections to prevent additional unauthorized transfers. The team is also working with exchanges and law enforcement agencies to track and potentially recover the stolen funds.
Growing List of Crypto Exploits
The Secret Network incident is among the largest cryptocurrency exploits reported this month. Data from DeFiLlama shows that more than 20 protocol hacks and exploits have already occurred during the period.
Only the Humanity Protocol exploit, which resulted in losses of about $32 million, and the Syscoin Bridge attack, which caused roughly $8 million in losses, exceeded the size of the Secret Network breach.
Despite news of the exploit, SCRT briefly climbed nearly 6% before settling around $0.058. The token remains approximately 99% below its all-time high reached in 2021.
