A critical “infinite mint” vulnerability inside a modified CW20-ICS20 bridge contract allowed an attacker to drain approximately $4.67 million in assets from the Secret Network ecosystem. The exploit functioned by manipulating an Inter-Blockchain Communication (IBC) channel, empowering the hacker to forge deposits and mint unbacked Secret-wrapped tokens (saTokens). Those unbacked tokens were then successfully redeemed for real collateral out of the Axelar escrow account.
The technical structure of the theft exposes a severe vulnerability in decentralized interoperability protocols. The initial breach actually took place on June 10, 2026, resulting in the $4.67 million loss, but an isolated vulnerability in the Secret Network-side contract and default encryption caused a seven-day detection delay. Because Secret Network explicitly encrypts user balances and smart contract states by default, the missing bridge collateral was completely masked from public view.
Network operators only discovered the hack on June 17 when a legitimate user attempted a cross-chain transfer and the transaction failed due to insufficient funds remaining in the Axelar escrow.
To execute the heist, the attacker built a custom single-validator Cosmos chain and used a fake IBC channel to bypass standard validation metrics. Blockchain security researchers at Common Prefix mapped the multi-chain laundering route, tracking the stolen funds as they moved through Osmosis before being bridged directly to Ethereum via Circle’s Cross-Chain Transfer Protocol (CCTP) for final liquidation.
Who Holds the Liability in Cross-Chain Exploits?
The aftermath of the June 10 exploit has generated immediate cross-protocol friction. Secret Network representatives indicated that Axelar failed to respond to emergency asset freeze requests while the funds were being laundered, raising an industry-wide question regarding incident response liabilities across decentralized infrastructure.
When a bridge spans two independent blockchains, emergency response protocols often break down at the borders of each network’s jurisdiction. If one protocol cannot unilaterally freeze assets held in another’s escrow, the decentralized nature of the system actively accelerates the attacker’s ability to liquidate the funds. This incident proves that without standardized, cross-chain emergency execution, encrypted privacy networks run the risk of inadvertently shielding attackers from real-time detection.