Secret

Axelar

Cosmos

<p>An attacker drained roughly $4.67 million from a <strong>Secret</strong><a href="https://yellow.com/asset/scrt" rel="noopener noreferrer nofollow">(SCRT)</a> bridge tied to <strong>Axelar</strong><a href="https://yellow.com/asset/axl" rel="noopener noreferrer nofollow">(AXL)</a>, exploiting a flawed contract that minted unbacked tokens out of nothing.</p>
<h2 id="key-points">Key Points:</h2>
<blockquote>
 <ul>
  <li>A flawed Secret Network contract let an attacker mint unbacked tokens, draining about $4.67 million.</li>
  <li>The theft stayed hidden for seven days until a failed transfer exposed the empty escrow.</li>
  <li>Axelar disabled the affected connections and said its core protocol was never touched.</li>
 </ul>
</blockquote>
<h2 id="secret-network-bridge-loses-millions">Secret Network Bridge Loses Millions</h2>
<p>The theft began on Jun. 10 yet went unnoticed for seven days, since Secret encrypts balances by default and the missing collateral never showed on chain. It surfaced only on Jun. 17, when a routine cross-chain transfer failed because the escrow account had run dry. Investigators then traced the shortfall back to seven suspicious withdrawals made on the opening day.</p>
<p>Axelar <a href="https://crypto.news/axelar-shuts-down-secret-network-bridge-routes-after-4-7m-exploit/" rel="noopener noreferrer nofollow">confirmed</a> the loss on Jun. 19 and disabled the affected Secret and Secret-SNIP connections within hours, while stressing that its core protocol was never touched. The team said it has contacted exchanges and law enforcement to trace the funds, about $672,000 of which still sits untouched in the attacker's main wallet.</p>
<p><strong>Also Read:</strong><a href="https://yellow.com/news/bitcoin-etf-exodus-record-635m-panic-selling-cooling" rel="noopener noreferrer nofollow">Bitcoin ETF Exodus Hits Record $6.35B, But Panic Selling May Be Cooling</a></p>
<h2 id="infinite-mint-flaw-fooled-the-contract">Infinite-Mint Flaw Fooled The Contract</h2>
<p>The vulnerable contract minted Secret-wrapped copies of bridged assets but never verified which channel a deposit truly came from, matching only a token's name against an approved list.</p>
<p>Research firm <strong>Common Prefix</strong><a href="https://www.cryptotimes.io/2026/06/20/how-a-custom-code-flaw-cost-secret-network-4-67-million/" rel="noopener noreferrer nofollow">published</a> a postmortem mapping how that single gap unraveled. Because the network hides transfers by default, tracing the attacker proved far harder than it would have on a fully transparent public ledger.</p>
<p>To exploit it, the attacker spun up a chain with one validator, opened an unauthorized channel, and self-relayed forged packets carrying token names lifted straight from the allow-list.</p>
<p>The contract accepted them and minted real, redeemable tokens with nothing whatsoever behind them.</p>
<p>Redeeming those fakes through the genuine channel then emptied the escrow across seven wrapped assets. The flaw was not new, and the firm <a href="https://www.cryptopolitan.com/axelar-bridged-tokens-worth-4-67-million-drained-in-secret-network-contract-exploit/" rel="noopener noreferrer nofollow">reported</a> that the same logic had sat in the code since 2023 and survived a March 2026 migration. Secret added that no outside audit was requested when the bridge was first built.</p>
<h2 id="cross-chain-bridges-stay-exposed">Cross-Chain Bridges Stay Exposed</h2>
<p>The stolen funds moved through Osmosis, swapped into <strong>Ether</strong><a href="https://yellow.com/asset/eth" rel="noopener noreferrer nofollow">(ETH)</a> on a decentralized exchange, and scattered across dozens of fresh wallets before finally reaching three centralized exchanges. The broader market response stayed muted, with Axelar's token slipping about 2.2% on the day and Secret holding nearly flat.</p>
<p>Still, the loss extends a brutal year for cross-chain infrastructure. Bridges built on similar lock-and-mint designs remain the most exploited surface in crypto, with comparable flaws <a href="https://www.banklesstimes.com/articles/2026/06/20/secret-network-bridge-exploit-drains-4-67m-from-axelar-link/" rel="noopener noreferrer nofollow">costing</a> more than $340 million across the industry in 2026. The toll includes a $25 million breach at Resolv, an $11 million loss at Verus, and a $4 million hit to IoTeX.</p>
<p><strong>Read Next:</strong><a href="https://yellow.com/news/jaredfromsubway-bot-loses-75m-own-bait" rel="noopener noreferrer nofollow">JaredFromSubway Bot Loses $7.5M After Taking Its Own Bait</a></p>

Secret Network’s $4.67M Bridge Heist Started With One Missing Check

Table of Contents

Yellow News

Other articles published on Jun 21, 2026

Join our free newsletter for daily crypto updates!