Axelar-bridged tokens worth $4.67 million drained in Secret Network contract exploit

Approximately $4.67 million worth of tokens were drained from Secret Network after an attacker exploited an ICS-20-based smart contract used to facilitate cross-chain transfers, according to Axelar’s June 19 statement.

The incident exposed another weakness in the bridge infrastructure connecting Cosmos-based blockchains, but Axelar said the issue was isolated to the Secret-side ICS-20 smart contract used in the Cosmos IBC connection between Secret and Axelar. The company said Axelar’s core protocol, other IBC connections, other chains, and other escrow accounts were not affected.

The stolen assets were tokens bridged from Axelar to Secret Network, a privacy-focused blockchain built with the Cosmos SDK. According to blockchain security research firm Common Prefix, the attacker exploited a modified CW20-ICS20 token contract on Secret and stole about $4.67 million across seven assets, including wrapped USDT, USDC, DAI, WETH, WBTC, WBNB, and wstETH.

Secret-side contract flaw drains Axelar-bridged assets

Common Prefix said the vulnerability sat in a modified CW20-ICS20 contract deployed on Secret Network to process incoming IBC transfers, according to reporting summarized by Binance Square.

This contract was used to generate wrapped forms of Axelar-bridged tokens after users made deposits of their tokens into Secret using the IBC protocol. However, the contract did not verify two important prerequisites; whether the token transfers were actually initiated through an authentic Axelar-controlled IBC channel and whether the redemptions request more than what is available in escrow.

With these prerequisites ignored, the contract accepted all malicious IBC packets as valid if the token ID was in the allowlist.

Fake IBC packets created unbacked wrapped tokens

According to Common Prefix’s analysis, the attacker created a minimal Cosmos blockchain with a single validator, opened a new IBC channel to Secret Network, and sent fake deposit packets through that route.

The vulnerable contract received the packets and created unbacked wrapped tokens on Secret. The attack proceeded by redeeming the wrapped tokens via the proper Axelar mechanism, emptying escrow accounts with actual bridged assets.

Common Prefix claimed that the contract did not check from what IBC channel the tokens were coming in. This made it possible for the malicious packets sent via the controlled chain to be accepted as the right bridge operation.

The issue appears to have existed for a long period. Common Prefix traced the missing validation back to early public commits in 2023 and said a March 2026 migration carried the same logic forward instead of removing the underlying weakness.

The structural failure was message authentication. The system assumed upstream components would handle authentication, but that assumption did not hold under the attacker’s routing setup. As a result, spoofed messages could pass through when the channel and token conditions aligned.

Emergency response isolates the affected route

Axelar stated that their emergency task force disconnected the relevant IBC connection to Secret Network immediately upon identifying the incident.

The group emphasized that there has been no breach in the core protocol of Axelar and that the problem remained confined to Secret Network only. Axelar also said it was contacting exchanges and law enforcement.

For users who bridged assets from Axelar to Secret through the affected route, the immediate problem is redemption. With the escrow account drained, wrapped assets on Secret can no longer be redeemed for the underlying tokens through that channel.

Recovery may also be more complicated than in a typical public-chain bridge exploit because Secret Network encrypts balances and transfers by default. That means the attacker’s wallet and exploit transactions are harder to inspect through standard public block explorers.

Bridge security faces another validation test

The $4.67 million loss is smaller than some of the largest bridge hacks, but the incident still matters because it hit a familiar weak point: cross-chain message validation.

As Cryptopolitan earlier reported, a Syscoin bridge was paused this month after an attacker exploited a validation flaw to mint roughly 5 billion unauthorized SYS tokens. That incident added to a growing list of bridge exploits in 2026.

In February, CrossCurve lost an estimated $3 million after attackers exploited vulnerabilities in the protocol’s smart contracts, according to Halborn’s post-mortem.

The Secret case is evidence that the one unaddressed assumption in cross-chain infrastructure is sufficient to cause an entire escrow drain incident. It is possible for an underlying protocol to remain uncompromised while the contracts that sit at the edge of a bridge can still expose user funds.

Both Axelar and Secret Network have stated that a full post-mortem is being compiled. Until then, the compromised channel serves as a warning that bridge security is not just about the primary protocol, but also every smart contract that handles inter-chain communications.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.