A security incident led to the loss of about $4.7 million worth of assets on the Axelar cross-chain interoperability protocol, which has since shut down its bridge functionality with the Secret Network.
Exploit Traced to Secret Network’s ICS-20 Smart Contract
The hacker exploited assets being moved from the Axelar network to the Secret network via the Cosmos IBC (Inter-Blockchain Communication) protocol, according to Axelar. Initial findings indicate that the vulnerability was not in Axelar’s core infrastructure, but instead in the Secret-side ICS-20 smart contract that is managing IBC transfers between the two networks.
For the incident, Axelar’s emergency committee closed down the connections of the Secret and Secret-SNIP bridge to prevent further losses and contain the attack. The protocol also confirmed that it has engaged relevant cryptocurrency exchanges and relevant authorities in its investigation.
The Secret Network is a blockchain that supports privacy and allows data associated with transactions to be encrypted, but not lose the ability to verify on-chain execution of smart contracts. The network has been used to create private cross-chain applications, such as confidential decentralized finance (DeFi) services, privacy-preserving NFT transactions, and anonymous governance mechanisms, among other applications.
Axelar Says Exploit Was Limited to Bridged Assets
According to Axelar, the attack seems to be confined to funds that were transferred to the Secret Network from the Axelar network. There is no evidence so far that any Secret-native assets have been compromised, nor any other IBC connections, nor any additional Axelar integrations, the company said.
The protocol stressed that its wide network was not compromised during the event. The issue is thought to be limited to the Secret-side contract that handles inbound transfers to the Secret ecosystem from Axelar.
Bridge routes in the affected area will continue to be closed until the attack vector has been investigated in detail and the extent of the damage assessed. Once it has finished its investigation, Axelar will be publishing a detailed post-mortem report, the company said.
The attack is part of a number of recent security incidents targeting cryptocurrency infrastructure projects in the past few weeks.
Earlier this month, Humanity Protocol announced its recovery efforts after it suffered an exploit on June 8, which prompted the project to withdraw its original H token from Ethereum, BNB Chain, and Humanity Mainnet. Those affected will be able to receive a replacement token in the form of an “airdrop” based on a new and audited ERC-20 contract deployed on the Ethereum network, the company stated.
Humanity Protocol said the attack occurred due to stolen credentials and noted that there was no breach to the token contracts, bridge infrastructure, or Safe wallet setup.
Binance Research Highlights Growing Security Pressures
Other operational implications have resulted from security incidents. This week, crypto payments platform Pyra announced that it would end its operations after it decided that it could not recover from the losses it suffered due to the Drift exploit.
In this context, Axelar’s attention is now on finding out how the attack was carried out and how to limit the spread of the Secret Network exploit. As of now, the company said, there is no evidence that other parts of the Axelar ecosystem were affected.
The latest hack follows a series of other attacks on DeFi that have been driven by increasing security concerns. Binance Research recently estimated that the amount of funds stolen through DeFi exploits across the sector during April resulted in nearly $13 billion of total value locked (TVL) outflows in the sector.
The on-chain leverage ratio also increased to approximately 38%, which is around the same time since the 2021 downturn, when TVL started to contract more than borrowing.
Market participants will be keenly observing Axelar as investigations proceed to see if the company will provide a final verdict and take any action to enhance the security of cross-chain infrastructure.
