Secret Network Bridge Loses $4.7M to ‘Infinite Mint’ Flaw

An attacker exploited an “infinite mint” vulnerability in a smart contract on the Secret Network, creating wrapped Axelar assets without proper backing. The incident resulted in a reported $4.67 million loss, according to blockchain research firm Common Prefix.

The breach occurred on June 10 but was identified a week later, on June 17, after a failed cross-chain transaction triggered an “insufficient funds” error tied to the drained account, Common Prefix said in a report released Friday. The funds were then routed to Ethereum and distributed across multiple wallets before being moved to exchanges, the firm added.

Key takeaways

• Common Prefix attributes the $4.67 million exploit to an infinite-mint flaw in a Secret Network contract that minted unbacked Axelar-wrapped tokens.
• The issue was traced to missing verification of the source of inbound transfers before minting, allowing forged deposits on an attacker-controlled channel.
• Wrapped assets affected included saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB and sawstETH.
• Secret Network said holders of Axelar-bridged saXXX tokens may face loss, while both Secret and Axelar emphasized that Secret’s token SCRT and Axelar’s infrastructure were not directly compromised.

How the exploit worked on Secret’s Axelar bridge

Secret Network is a privacy-focused layer-1 blockchain built on the Cosmos ecosystem. Axelar, meanwhile, is designed to enable interoperability between different blockchain networks. The exploit targeted a smart contract handling Axelar-wrapped assets on Secret, where wrapped “saTokens” are expected to represent collateral held in escrow.

Common Prefix reported that the contract failed to verify the provenance of inbound transfers before minting. As a result, the attacker could “forge” deposits over an attacker-controlled channel, triggering the minting of “genuine saTokens with no assets backing them,” the firm said.

After minting, the attacker redeemed the Axelar-wrapped assets back through legitimate channels. Common Prefix said the redemption drained the real Axelar-wrapped assets held in escrow, converting the unbacked representations into backed value.

Timeline and discovery: from June 10 to June 17

While the exploit itself took place on June 10, the crucial indicator of trouble appeared later. Common Prefix said the breach was discovered on June 17 after a cross-chain transaction failed due to an “insufficient funds” error connected to the account that had been drained.

This delay matters for users because it highlights how bridge or escrow-related systems can continue operating normally—or at least not immediately signal obvious failures—until specific downstream actions surface the shortfall. In practice, that can mean the window between minting and detection may be long enough for assets to be redistributed before investigators fully connect the dots.

Where the stolen funds went

Common Prefix reported that after exploiting the wrapped tokens, the attacker moved the assets to the Ethereum blockchain and converted them to Ether (ETH). The firm also said the attacker split the proceeds among roughly 30 wallets.

Those wallets were then used to move funds into exchanges, including KuCoin, ChangeNow, and HitBTC, according to the report. The multi-wallet approach is a common tactic in laundering activity, aimed at complicating tracing by breaking up transaction flows and distribution patterns.

Which tokens were affected—and what Secret said to users

The affected Axelar-wrapped assets minted without backing included saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB and sawstETH. Common Prefix emphasized that the backing of these tokens was compromised, meaning token holders may not be able to redeem them for their intended collateral.

On Saturday, Secret Network issued a security notice stating that holders of Axelar-bridged saXXX tokens on Secret should expect their backing to be affected and that their funds “may be lost.”

Secret’s own native token, Secret (SCRT), was not reported as impacted by the incident. However, the notice underscores that this was not a general compromise of the network itself, but a targeted weakness in the minting path for specific bridged assets.

Axelar’s response: not compromised, firewall contained impact

Axelar acknowledged the incident on Saturday after “some confusion” emerged around the breach. In its statement, Axelar said neither Axelar nor IBC (Inter-Blockchain Communication) was compromised.

Axelar added that the exploited token smart contract “was not developed, deployed, or maintained by Axelar,” and that Axelar’s firewalling prevented the impact from spreading to other chains.

For investors and builders, the distinction is significant: it narrows the likely source of failure to the contract logic on the Secret side rather than Axelar’s core interoperability infrastructure. Even so, cross-chain systems remain tightly coupled through assumptions about escrow, message integrity, and minting verification—exactly where this exploit appears to have broken those assumptions.

Part of a wider wave of protocol attacks

This breach arrives amid a broader pattern of cross-chain and protocol exploitation. Common Prefix noted it is among a series of hacks and exploits occurring this month, with at least 22 incidents reported by DeFiLlama’s ongoing hack tracking.

Within that same recent period, other reported bridge-related losses included Humanity Protocol and Syscoin Bridge, which earlier this month suffered reported losses of $32 million and $8 million respectively, according to coverage referenced in Common Prefix’s context.

While each event has its own root cause, the recurring theme is similar: many of the highest-value failures occur where bridging logic meets asset accounting—especially when systems mint representations based on messages or deposits that are not strongly authenticated end-to-end.

Going forward, users holding affected saTokens should watch for further announcements from Secret and for any guidance on whether and how remaining balances can be redeemed. The key open question is how quickly and completely the affected minting pathway can be audited and patched—because in cross-chain ecosystems, even small verification gaps can translate into real, backed-value drains once an attacker finds a redemption route.