Secret Network / Axelar IBC Bridge Exploit (June 2026)
Summary
On approximately June 10, 2026, an attacker exploited a missing channel-verification check in a Secret Network-side ICS-20 smart contract governing the Cosmos IBC connection between Secret Network and Axelar, minting unbacked wrapped tokens that were redeemed for approximately $4.67 million in real bridged assets. The exploit went undetected for seven days due to Secret Network's privacy-by-default design, and was only discovered on June 17 when a routine cross-chain transfer failed due to depleted escrow. Axelar's emergency committee severed all Secret and Secret-SNIP IBC connections on June 17; the stolen funds were subsequently laundered through Osmosis, bridged to Ethereum, and deposited across KuCoin, ChangeNow, and HitBTC.
Connected Entities
1 entities · 10 linked investigationsTimeline(5 events)
2026-06-10
Attacker begins exploit, creating a custom single-validator Cosmos SDK chain, opening a fraudulent IBC channel to the vulnerable ICS-20 contract on Secret Network, and sending forged deposit packets to mint unbacked saTokens redeemable for real Axelar-bridged assets. Seven anomalous transactions later traced to this date.
BanklessTimes / CryptoTimes2026-06-10
Stolen assets routed through Osmosis, bridged to Ethereum, swapped for ETH via CoW Protocol, split across approximately 30 wallets, and deposited at KuCoin, ChangeNow, and HitBTC.
CryptoTimes2026-06-17
A routine cross-chain transfer fails due to insufficient escrow balance. Axelar investigators trace the shortfall to the June 10 transactions. Axelar's emergency committee immediately disables Secret and Secret-SNIP IBC connections.
BanklessTimes / CryptoTimes2026-06-19
Axelar publicly discloses the incident, confirming approximately $4.67 million in losses, the isolation of the breach to the Secret-side ICS-20 contract, and outreach to relevant exchanges and law enforcement agencies. Multiple crypto news outlets report the incident.
Axelar via crypto.news / CryptoTimes / AMBCrypto / The Merkle2026-06-20
Additional reporting published. No recovery, compensation mechanism, or restoration timeline for Secret Network IBC connections announced. Post-mortem stated to be in preparation.
BanklessTimesDecision Log
- hash: 6rechLCGAK5vZjqV7mZ2kaoyt4z6WKtzWFAYy7hjzF56
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/20/2026, 12:03:38 PM
last updated: 6/20/2026, 12:03:50 PM
avoid.net — verified advice for a post-truth world