Secret Network / Axelar Bridge Exploit June 2026
Last changed 2026-11-01 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the judge moved the trust score from 8 to 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·29ZFau…PxRGSummary
On June 10, 2026, an attacker exploited a missing channel-origin validation in a customized CW20-ICS20 smart contract on Secret Network to mint unbacked Axelar-wrapped saTokens and redeem them for approximately $4.67 million in real escrowed assets. The exploit went undetected for seven days, in part because Secret Network's privacy-by-default design encrypts balances, until a failed cross-chain transfer on June 17 exposed the shortfall; Axelar then disabled the Secret and Secret-SNIP IBC connections. The flaw is reported to date to the contract's 2023 deployment and was carried forward unaudited through a March 5, 2026 migration; the stolen funds were laundered via Osmosis, Ethereum and CoW Protocol to KuCoin, ChangeNow and HitBTC, and no compensation had been announced.
Connected Entities
8 entities · 60 linked investigations- KuCoin→mentioned with→Ethereum(60%)
- ChangeNOW→mentioned with→Ethereum(65%)
- Resolv→mentioned with→Ethereum(60%)
- Secret Network / Axelar Bridge Exploit June 2026→mentioned with→ChangeNOW(60%)
- Secret Network / Axelar Bridge Exploit June 2026→mentioned with→Syscoin Bridge(80%)
- Secret Network / Axelar IBC Bridge Exploit (June 2026)→mentioned with→Secret Network / Axelar Bridge Exploit June 2026(85%)
- Secret Network / Axelar Bridge Exploit June 2026→mentioned with→Secret Network / Axelar IBC Bridge Exploit (June 2026)(90%)
- Secret Network / Axelar IBC Bridge Exploit (June 2026)→mentioned with→ChangeNOW(70%)
- Secret Network / Axelar IBC Bridge Exploit (June 2026)→mentioned with→Cosmos (ATOM)(80%)
- Secret Network / Axelar Bridge Exploit June 2026→mentioned with→Cosmos (ATOM)(75%)
- + 7 more
1 submission awaiting moderator review.
Timeline(8 events)
March 2023
Vulnerable CW20-ICS20 bridge contract originally deployed on Secret Network without the parse_voucher_denom() and reduce_channel_balance() validation checks. No external security audit was requested.
Common Prefix postmortem (via CryptoTimes and yellow.com)March 2026
On March 5, 2026, the contract is migrated to Code ID 2446 to add new functionality. The migration preserves the missing source-validation checks without remediation and without triggering a new security audit.
CryptoTimes / Common Prefix postmortemJune 2026
On June 10, 2026, the attacker creates a single-validator Cosmos SDK chain, opens an unauthorized IBC channel to the vulnerable bridge contract, self-relays forged packets, and mints approximately $4.67 million in unbacked saTokens across seven asset classes before redeeming them for real escrowed assets. Seven anomalous withdrawals are later traced to this date.
CryptoTimes, The Block, CryptoWisser, BanklessTimesJune 2026
Following the exploit, stolen assets are routed through Osmosis, bridged to Ethereum, swapped for ETH via CoW Protocol, split across approximately 30 wallets, and deposited at KuCoin, ChangeNow and HitBTC.
CryptoTimesJune 2026
On June 17, 2026, a routine cross-chain transfer fails due to insufficient escrow reserves, exposing the shortfall; investigators trace the deficit to the June 10 withdrawals. Axelar's emergency committee disables the Secret and Secret-SNIP IBC connections (other accounts date the disabling to June 19).
BanklessTimes / CryptoTimes / CryptoWisserJune 2026
On June 19, 2026, Axelar publicly discloses the incident, confirming approximately $4.67 million in losses, the isolation of the breach to the Secret-side ICS-20 contract, and outreach to exchanges and law enforcement. Squid router removes Secret Network from its interface. Secret Network and multiple outlets report the incident.
Axelar via crypto.news / CryptoTimes / KuCoin / AMBCrypto / The MerkleJune 2026
On June 20, 2026, CryptoTimes publishes a technical analysis detailing the two missing validation functions, the March 2026 migration history and the attacker's methodology; yellow.com and BanklessTimes publish further analysis attributing the postmortem to Common Prefix. No recovery, compensation mechanism or restoration timeline is announced.
CryptoTimes, yellow.com, BanklessTimesJune 2026
Around June 22, 2026, Cointelegraph and other outlets publish further coverage; SCRT is reported down approximately 28.5% for the month. Axelar clarifies that its core protocol was not breached and that the exploited contract was not its responsibility.
CoinTelegraph via TradingView, KuCoin, CryptoWisserDecision Log
- slot 464283999 · hash 4SwN1p3jD5KKm9NbNDnUWy5LA6CxA8XVmCvorHDKWMGv
- slot 464283994 · hash EaCBLwpViTG3WgE2wMJcoqscQRxFY35ZncSyZkGzRGkK
- slot 429920113 · hash 72cYoiUnmLCfUo23WJSUMtnHuJLdMks6KVxkiH1ksPaU
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 21 of 21 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/30/2026, 5:09:32 PM
last updated: 11/1/2026, 11:53:22 PM
4 viewsavoid.net — verified advice for a post-truth world