Axelar Network, a Layer-1 blockchain used to move tokens between different networks, said about $4.67 million was taken from tokens bridged from Axelar to Secret Network, a privacy-focused blockchain in the Cosmos ecosystem.
The company disclosed the incident in a Friday X post, saying the affected assets were tokens bridged from Axelar to Secret Network.
- Axelar said its emergency committee disabled the Secret and Secret-SNIP connections after becoming aware of the incident.
- The team said it's also contacting exchanges and law enforcement agencies.
Axelar noted that the incident was isolated to assets on Secret bridged over IBC from Axelar, adding that no other IBC connections or Secret tokens appear to be affected.
Read also: Drift Recovery Token portal opens after April platform hack
- The team also said no other Axelar integrations were affected and that Axelar's core protocol wasn't affected.
- The company didn't name the attacker, list the specific tokens taken or say whether any funds had been frozen or recovered.
- In an X post on June 20, Axelar said there was "some confusion around the Secret Network incident," noting that "neither Axelar nor IBC was compromised," and adding that the exploited token contract wasn't developed, deployed or maintained by Axelar.
- Axelar said the vulnerable Secret-side contract was a fork of the CW20-ICS20 implementation with two core security checks removed, which enabled an "infinite mint" bug.
The incident appears to be related to a contract-side failure on Secret's side of the Axelar-Secret IBC route, based on Axelar's current description, which means the reported loss is tied to a specific bridge path, not to every Axelar connection or every Secret Network token.
Axelar said it is preparing a detailed post-mortem, which should clarify the exact cause, affected assets, timeline and any recovery plan.
- Founded in 2020 by Sergey Gorbunov and Georgios Vlachos, former founding team members at Algorand, Axelar began rolling out its mainnet in early 2022.
- Axelar has disclosed at least $63.75 million in venture funding, including a $3.75 million seed round backed by Binance-linked investors and DCVC, a $25 million Series A led by Polychain Capital, and a $35 million Series B with Dragonfly Capital, Polychain Capital and North Island Ventures among its backers.
Update June 20, 8:37 p.m. UTC. Added Axelar Network's statement on X that neither Axelar nor IBC was compromised. Updated title for clarity.