Secret Network / Axelar IBC Bridge Exploit (June 2026)
Summary
On approximately June 10, 2026, an attacker exploited a missing channel-verification check in a Secret Network-side ICS-20 smart contract governing the Cosmos IBC connection between Secret Network and Axelar, minting unbacked wrapped tokens that were redeemed for approximately $4.67 million in real bridged assets. The exploit went undetected for seven days due to Secret Network's privacy-by-default design, and was only discovered on June 17 when a routine cross-chain transfer failed due to depleted escrow. Axelar's emergency committee severed all Secret and Secret-SNIP IBC connections on June 17; the stolen funds were subsequently laundered through Osmosis, bridged to Ethereum, and deposited across KuCoin, ChangeNow, and HitBTC.
Connected Entities
1 entities · 10 linked investigationsCommunity submissions
- Under reviewincriminatingWayback pending6/28/2026, 4:13:22 PM
“The Block reporting on the 4.67M infinite-mint exploit: 7-day detection delay, fund flow traced to KuCoin/ChangeNow/HitBTC, vulnerability in contract since 2023 deployment, Axelar emergency bridge shutdown June 17.”
— avoid-scout
- Under reviewincriminatingWayback pending6/26/2026, 10:08:36 PM
“The Secret Network / Axelar bridge exploit has been confirmed at $4.67M. The June 10 attack went undetected for 7 days because Namada-style encrypted balances obscured the drain on-chain. The attacker created a custom Cosmos SDK chain, opened a forged IBC channel, and minted unbacked wrapped tokens redeemable for real assets. The vulnerability traced to a missing source-channel validation check present since the 2023 deployment. Axelar shut down Secret bridge routes on June 17.”
— avoid-scout
Timeline(5 events)
2026-06-10
Attacker begins exploit, creating a custom single-validator Cosmos SDK chain, opening a fraudulent IBC channel to the vulnerable ICS-20 contract on Secret Network, and sending forged deposit packets to mint unbacked saTokens redeemable for real Axelar-bridged assets. Seven anomalous transactions later traced to this date.
BanklessTimes / CryptoTimes2026-06-10
Stolen assets routed through Osmosis, bridged to Ethereum, swapped for ETH via CoW Protocol, split across approximately 30 wallets, and deposited at KuCoin, ChangeNow, and HitBTC.
CryptoTimes2026-06-17
A routine cross-chain transfer fails due to insufficient escrow balance. Axelar investigators trace the shortfall to the June 10 transactions. Axelar's emergency committee immediately disables Secret and Secret-SNIP IBC connections.
BanklessTimes / CryptoTimes2026-06-19
Axelar publicly discloses the incident, confirming approximately $4.67 million in losses, the isolation of the breach to the Secret-side ICS-20 contract, and outreach to relevant exchanges and law enforcement agencies. Multiple crypto news outlets report the incident.
Axelar via crypto.news / CryptoTimes / AMBCrypto / The Merkle2026-06-20
Additional reporting published. No recovery, compensation mechanism, or restoration timeline for Secret Network IBC connections announced. Post-mortem stated to be in preparation.
BanklessTimesDecision Log
- hash: 6rechLCGAK5vZjqV7mZ2kaoyt4z6WKtzWFAYy7hjzF56
This investigation is cryptographically anchored to the Solana blockchain (1 event). 10 of 11 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/20/2026, 12:03:38 PM
last updated: 7/27/2026, 5:41:15 PM
avoid.net — verified advice for a post-truth world