Axelar Network was hacked, and approximately $4.67 million worth of tokens were stolen

Axelar Network stated on platform X that an event affecting assets bridged from the Axelar chain to the Secret Network via IBC has been discovered, with approximately $4.67 million worth of tokens stolen.

According to the information currently available, the issue is limited to the ICS-20 smart contract on the Secret side, which is part of the Cosmos IBC connection between Secret and Axelar, used to bridge assets from Axelar to Secret. The Axelar Emergency Committee immediately disabled the Secret and Secret-SNIP connections upon discovering the event. The team is contacting relevant exchanges and law enforcement agencies. The incident is limited to assets bridged from Axelar to Secret via IBC. Other IBC connections or Secret tokens do not appear to be affected. Other Axelar integrations are unaffected. The core protocol of Axelar is unaffected.

According to an analysis by Common Prefix on the Secret Network incident, an attacker exploited an infinite minting vulnerability in a modified CW20-ICS20 token contract on Secret, stealing approximately $4.67 million. The attacker minted arbitrary Secret-wrapped Axelar assets on Secret by launching a new Cosmos chain (with only one validator) and self-relaying IBC packets to it. The contract did not verify which IBC channel the inbound tokens came from. The attacker exited through the Axelar bridge. The Axelar protocol was not compromised and prevented the contagion from spreading to other chains.