Secret Network Bridge Suffers $4.7 Million Exploit Due to Infinite Mint Bug

Hackers have taken advantage of the “infinite mint” flaw in a smart contract that is vulnerable to exploitation and created unbacked versions of Axelar wrapped tokens worth $4.67 million (roughly Rs. 44.19 crore). While the hack took place on June 10, the hack was detected after a week on Wednesday, following a failure in a cross-chain transaction due to the error “insufficient funds” from the drained account, as revealed by blockchain research company Common Prefix on Friday. The hacking of the Secret Network remained unnoticed for a week because the criminal had moved the hacked money to Ethereum and then to exchanges.

Flaw Allowed Unbacked Tokens to Be Minted and Redeemed

As per Common Prefix, the hacker was able to redeem the Axelar-wrapped tokens (saTokens) via legitimate means to withdraw the actual Axelar-wrapped tokens that were being held in escrow since the smart contract had not verified the originator of the transaction before minting, thus “deposits forged over an attacker-controlled channel minted genuine saTokens with no assets backing them.” 

There have been no negative consequences for the Secret Network coin, Secret (SCRT), which is not affected by the latest developments, but the token is still down 99 percent from the all-time high in 2021 and is currently trading at $0.058 (roughly Rs. 5.49). Axelar (AXL) is in a similar state, trading at $0.045 (roughly Rs. 4.26), down 98 percent from its 2024 peak. 

Secret Network is a privacy-oriented layer-1 blockchain that operates on the Cosmos platform, whereas Axelar is a decentralised interoperability protocol connecting different blockchain platforms. The following tokens were created under the name of Axelar-wrapped without collateral during the hack: saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH. “If you hold Axelar-bridged saXXX tokens on Secret, please be aware their backing was affected, and your funds may be lost,” the Secret Network said on Saturday.

As per the data by DeFiLlama, this incident is one of a series of crypto protocols hacked that have occurred this month. The total number of hacks now stands at 22 in this period. Secret Network is one of the most significant exploits following the Humanity Protocol and Syscoin Bridge, which lost $32 million (roughly Rs. 302.78 crore) and $8 million (roughly Rs. 75.70 crore), respectively.

Another incident that occurred last month was when Echo Protocol, a DeFi protocol deployed on the Monad blockchain, was hacked after an attacker managed to mint around 1,000 unauthorised eBTC on the protocol. Blockchain analytics platform Lookonchain and security firm PeckShield observed that the hacker minted these eBTC worth around $76.7 million (roughly Rs. 725.74 crore). The attacker attempted to launder part of this loot by depositing 45 eBTC, worth around $3.45 million (roughly Rs. 32.64 crore), into the DeFi lending and liquidity management protocol Curvance.