Secret Network lost $4.67 million due to a cross-chain exploit, and the attack went unnoticed for seven days

**June 21 Update** Blockchain research firm Common Prefix revealed that hackers exploited a vulnerability in the cross-chain bridge contract connecting Secret Network and Axelar on June 10. The attackers created fake deposits, minted uncollateralized tokens, and cashed out roughly $4.67 million total. The breach went unnoticed for seven days until a standard cross-chain transfer failed on June 17—triggered by insufficient funds in the custodial account, which exposed the anomaly. The root cause of the vulnerability: two key functions responsible for verifying transfer origins were removed when the contract switched from a custodial model to a minting model. Additionally, the contract had not completed any external audits since its deployment in early 2023. Secret Network criticized Axelar, stating the bridge provider’s infrastructure failed to activate effective anomaly detection or emergency pause mechanisms before the large-scale theft. Stolen funds were routed through Osmosis to Ethereum, exchanged for ETH on CoW Protocol, then dispersed across centralized exchanges including KuCoin, ChangeNow, and HitBTC. Approximately $672,000 still resides in the attacker’s Axelar wallet. Secret Network requested Axelar freeze this address, but the request was denied. Axelar emphasized its core protocol was never compromised, and the exploited contract was not developed or maintained by the company. Axelar has since disabled the affected cross-chain connections and noted it is coordinating with exchanges and law enforcement to take further action.