On June 19, 2026, Axelar suspended its bridge connection to Secret Network after confirming a $4.67 million exploit that took place over a week earlier. The attacker leveraged a critical flaw in a modified CW20-ICS20 smart contract on the Secret side of the Cosmos IBC integration to mint unbacked wrapped tokens and drain real assets.
The attack unfolded on June 10, when an unauthorized actor created a private Cosmos chain and established a rogue IBC channel to the vulnerable contract. The contract, responsible for managing privacy-focused “saTokens” (like saUSDT, saUSDC), had its source-channel validation checks disabled or commented out. By relaying forged IBC deposit packets, the attacker generated large volumes of unbacked wrapped tokens, including wETH, wBTC, DAI, WBNB, and wstETH, then redeemed them through the legitimate Axelar–Secret channel, draining the equivalent escrowed assets.
The incident was discovered on June 17, prompting Axelar’s emergency committee to disable the Secret and Secret-SNIP bridge connections on June 19. Secret Network also paused related bridging activity. According to Axelar, the core protocol and other IBC routes remained unaffected, and no other chains were compromised. The team notified exchanges and law enforcement, with a full post-mortem expected after the investigation concludes.
The exploit underscores persistent risks in cross-chain infrastructure, where even isolated contract modifications can create large security gaps. Both Axelar and security researchers stressed the need for rigorous, independent auditing of IBC-enabled contracts—particularly when handling wrapped assets—to maintain the integrity of cross-chain transfers.
