Secret Network – Axelar IBC bridge hack — June 2026

Secret Network's bridge to Axelar ran a customised fork of the CW20-ICS20 contract, which mints wrapped tokens on Secret when a matching IBC transfer arrives. In the fork, two checks present in the upstream code had been commented out: the routine that validates the voucher denomination against the packet's source channel, and the routine that caps releases at the amount actually escrowed for that channel. The contract therefore minted whenever an incoming denomination matched its allowlist, regardless of which channel the packet came from. Common Prefix traced the missing checks to the repository's first commit in January 2023, and the flawed code survived a migration in March 2026. The contract was an unaudited fork.

Because IBC channel opening is permissionless, on 10 June 2026 an attacker stood up a chain under their own control, opened a channel to the bridge contract and sent seven forged deposit packets. The contract minted unbacked saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB and sawstETH, and the attacker redeemed them back through the genuine Axelar channel within about 18 minutes, draining the real reserves held on the Axelar side.

Secret Network says Axelar notified it on 17 June 2026, after which the Axelar emergency committee disabled the Secret and Secret-SNIP connections and bridging was switched off on the Secret tunnel front end. Both parties put the loss at about $4.67 million. The proceeds moved through Osmosis to Ethereum and BNB Chain, were consolidated into roughly 2,349 ETH, split across about 30 addresses, and cashed out mainly through ChangeNOW and KuCoin. About $770,000 remained in the attacker's Axelar wallet, which Secret says Axelar declined to freeze. Secret's core protocol, native SCRT and other IBC routes were unaffected.