Secret Network's Axelar bridge drained for $4.67 million in exploit (2 minute read) (opens in new tab)

An attacker exploited a missing validation check in a Secret Network ICS-20 smart contract, a flaw present since the contract's March 2023 deployment and preserved through a March 2026 migration, by spinning up a fake Cosmos chain, opening a new IBC channel to Secret, and self-relaying forged packets to mint unbacked bridged tokens and drain real assets from escrow. The attack occurred on June 10 and went undetected for seven days until a routine cross-chain transfer failed due to an empty es...