A major security incident has shaken the Cosmos ecosystem after attackers exploited a vulnerability in a Secret Network bridge contract, draining approximately $4.67 million worth of assets linked to the Axelar interoperability network. The exploit reportedly remained undetected for seven days, allowing the attacker to mint unbacked assets and redeem them for real tokens before the breach was discovered.
The incident has reignited concerns about cross-chain bridge security, a sector that has repeatedly become a target for hackers due to the complexity of validating transactions across multiple blockchain networks. While early reports initially raised fears of an Axelar protocol compromise, investigators say the vulnerability appears to have been isolated to a Secret Network-side smart contract rather than Axelar’s core infrastructure.
According to Axelar, the attack affected assets bridged from the Axelar chain to Secret Network through the Inter-Blockchain Communication (IBC) framework. The company stated that approximately $4.67 million in tokens were stolen through a flaw in the ICS-20 smart contract responsible for handling incoming bridged assets on Secret Network.
Researchers from Common Prefix reportedly found that the attacker created a separate Cosmos-based blockchain with a single validator and established a new IBC connection to Secret Network. By sending forged transfer messages through this controlled environment, the attacker was able to trigger the minting of wrapped assets on Secret Network without depositing any genuine collateral.
Once the counterfeit assets were created, the attacker redeemed them through legitimate bridge mechanisms connected to Axelar. This process drained real tokens held in escrow accounts backing the bridged assets. Investigators estimate that seven token types were affected, including wrapped versions of USDT, USDC, DAI, WETH, WBTC, WBNB, and wstETH.
The exploit has been described by researchers as an “infinite-mint” attack because the vulnerability allowed the creation of synthetic assets without any corresponding deposits. The flaw effectively bypassed one of the most important security assumptions in bridge infrastructure: ensuring that only authenticated cross-chain messages can trigger token issuance.
Axelar responded quickly once the breach was identified. The network’s emergency committee disabled the Secret Network and Secret-SNIP bridge connections to prevent additional losses while investigators assessed the scope of the incident. The interoperability platform also confirmed that it has contacted exchanges and law enforcement agencies as part of its response efforts.
Importantly, Axelar maintains that its core protocol was not compromised. The company said current evidence indicates the issue was limited to the Secret-side contract responsible for handling specific IBC transfers. Other Axelar integrations, IBC routes, escrow accounts, and supported blockchains appear unaffected based on the ongoing investigation.
The incident is particularly challenging to analyze because Secret Network is designed as a privacy-focused blockchain. Transaction amounts, balances, and wallet activity are encrypted by default, making traditional on-chain forensic analysis significantly more difficult than on public chains such as Ethereum or Solana. As a result, tracing the stolen assets may prove more complicated than in many previous bridge exploits.
Investigators believe the underlying vulnerability may have existed for years. Reports indicate that the missing validation logic was present in earlier versions of the contract and was carried forward through subsequent updates without being fully addressed. If confirmed, that would mean the weakness remained dormant until an attacker discovered a practical way to exploit it.
The attack adds to a growing list of bridge-related security failures that have impacted the cryptocurrency industry in 2026. Cross-chain protocols continue to represent some of the most attractive targets for hackers because they manage large pools of collateral while relying on complex message verification systems. Even when a bridge’s primary protocol remains secure, vulnerabilities in surrounding contracts can still expose user funds.
For users affected by the incident, the immediate concern is whether bridged assets can be fully redeemed while the compromised route remains offline. Axelar has not yet announced a final recovery plan but says a comprehensive post-mortem is being prepared. Both Axelar and Secret Network are expected to release additional details once forensic investigations are complete.
The $4.67 million loss may be smaller than some of the industry’s largest bridge hacks, but security experts say the exploit highlights a recurring lesson in decentralized finance: a single overlooked validation check can undermine an entire cross-chain system. As blockchain interoperability becomes increasingly important to the crypto economy, incidents like this are likely to intensify calls for stricter auditing standards and more rigorous security reviews across bridge infrastructure.
