Infinite mint bug drains $4.67M from Secret Network bridge

An attacker exploited an infinite-mint bug in a smart contract on Secret Network on June 10 to create unbacked Axelar-wrapped tokens and withdraw $4.67 million. The incident was detected on June 17 after a failed cross-chain transaction surfaced an insufficient funds error in a drained account.

The vulnerable contract minted saTokens without verifying the origin of incoming transfers. Forged deposits sent over an attacker-controlled channel produced genuine saTokens with no assets backing them. The tokens minted without backing included saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB and sawstETH.

The attacker redeemed the forged saTokens through legitimate channels to withdraw the real assets held in Axelar escrow. The proceeds were moved to the Ethereum network, converted to ether, split across about 30 wallets and later deposited into exchanges including KuCoin, ChangeNow and HitBTC, according to blockchain researchers who traced the transfers.

Secret Network issued a warning to users that Axelar-bridged saXXX tokens on Secret may have lost their backing and that affected balances could be at risk. Secret Network’s native token SCRT was not impacted by the exploit.

Axelar confirmed that neither its network nor the Inter-Blockchain Communication protocol was compromised. Axelar also stated the exploited token contract was not developed, deployed or maintained by Axelar and that firewalling measures prevented the issue from spreading to other chains.

At least 22 crypto protocol hacks and exploits have been recorded this month, and the Secret Network loss ranks among the larger breaches, behind Humanity Protocol’s $32 million loss and the Syscoin Bridge’s $8 million loss.

Blockchain security teams and the affected projects are continuing investigations and tracking the movement of stolen funds. Users holding Axelar-bridged tokens on Secret are advised to verify the backing of their saTokens and follow official project channels for updates.