ChainCatcher reported that Axelar Network said on X that it had identified an incident affecting assets bridged from the Axelar chain to Secret Network through IBC. Around $4.67 million worth of tokens were stolen. Based on the information currently available to Axelar, the issue was limited to the ICS-20 smart contract on the Secret side. That contract is part of the Cosmos IBC connection between Secret and Axelar and is used to bridge assets from Axelar to Secret.
Secret and Secret-SNIP connections disabled
Axelar said its emergency committee disabled the Secret and Secret-SNIP connections immediately after discovering the incident. The team is contacting relevant exchanges and law enforcement agencies. Axelar described the incident as limited to assets that were bridged from Axelar to Secret through IBC. Other IBC connections or Secret tokens did not appear to be affected, and other Axelar integrations were not affected.
Axelar also stated that its core protocol was not affected. In its description, the affected area was not Axelar’s core protocol itself, but a specific smart-contract component on the Secret side of the IBC connection between Secret and Axelar. The statement separated the affected bridged assets and connections from the parts that Axelar said remained unaffected.
Common Prefix says attacker used an infinite mint vulnerability
Separately, according to Common Prefix’s analysis of the Secret Network incident, an attacker exploited an infinite mint vulnerability in a modified CW20-ICS20 token contract on Secret and stole about $4.67 million. The attacker launched a new Cosmos chain with only one validator and self-relayed IBC packets to it as part of the attack process.
Common Prefix said this allowed the attacker to mint arbitrary Secret-wrapped Axelar assets on Secret. The contract did not verify which IBC channel inbound tokens came from. The attacker then exited through the Axelar bridge. Common Prefix’s analysis also said the Axelar protocol was not compromised and that contagion to other chains was prevented.