Scan to download
BTC $59,233.97 -1.31%
ETH $1,582.14 +0.38%
BNB $548.66 -0.85%
XRP $1.04 -1.02%
SOL $73.56 +0.60%
TRX $0.3174 -1.73%
DOGE $0.0724 -0.56%
ADA $0.1446 -0.34%
BCH $201.15 +2.51%
LINK $7.27 -0.67%
HYPE $65.68 +3.49%
AAVE $89.32 -3.24%
SUI $0.6943 +0.67%
XLM $0.1786 +3.65%
ZEC $392.73 +2.38%
BTC $59,233.97 -1.31%
ETH $1,582.14 +0.38%
BNB $548.66 -0.85%
XRP $1.04 -1.02%
SOL $73.56 +0.60%
TRX $0.3174 -1.73%
DOGE $0.0724 -0.56%
ADA $0.1446 -0.34%
BCH $201.15 +2.51%
LINK $7.27 -0.67%
HYPE $65.68 +3.49%
AAVE $89.32 -3.24%
SUI $0.6943 +0.67%
XLM $0.1786 +3.65%
ZEC $392.73 +2.38%

67

All
Article
Flash

Secret Network lost 4.67 million dollars due to a cross-chain vulnerability, and the attack went undetected for seven days

The blockchain research organization Common Prefix disclosed that on June 10, hackers exploited a vulnerability in the Secret Network and Axelar cross-chain bridge contract to forge deposits and mint uncollateralized tokens, subsequently cashing out approximately $4.67 million.The attack went undetected for seven days until a normal cross-chain transfer failed due to insufficient funds in the escrow account on June 17, revealing the anomaly. The root of the vulnerability lies in the fact that when the contract changed from an escrow model to a minting model, it deleted two key functions responsible for verifying the source of transfers, and it had never undergone an external audit since its deployment in early 2023. Secret Network pointed out that the Axelar bridging infrastructure failed to trigger any effective anomaly monitoring or emergency pause mechanism before the assets were stolen on a large scale.The stolen funds were routed through Osmosis to Ethereum and exchanged for ETH on CoW Protocol, then dispersed into exchanges such as KuCoin, ChangeNow, and HitBTC. Currently, approximately $672,000 remains in the attackers' Axelar wallet. Secret Network has requested Axelar to freeze that address, but the request was denied. Axelar emphasized that its core protocol was never affected, and the exploited contract was not developed or maintained by Axelar. Currently, Axelar has disabled the related cross-chain connections and stated that it is coordinating follow-up actions with exchanges and law enforcement agencies.

Axelar Network was hacked, and approximately 4.67 million dollars worth of tokens were stolen

Axelar Network stated on platform X that an event affecting assets bridged from the Axelar chain to the Secret Network via IBC has been discovered, with approximately $4.67 million worth of tokens stolen.According to the information currently available, the issue is limited to the ICS-20 smart contract on the Secret side, which is part of the Cosmos IBC connection between Secret and Axelar, used to bridge assets from Axelar to Secret. The Axelar Emergency Committee immediately disabled the Secret and Secret-SNIP connections upon discovering the incident. The team is contacting relevant exchanges and law enforcement agencies. The incident is limited to assets bridged from Axelar to Secret via IBC. Other IBC connections or Secret tokens do not appear to be affected. Other Axelar integrations are unaffected. The core protocol of Axelar is not impacted.Additionally, according to Common Prefix's analysis of the Secret Network incident, an attacker exploited an infinite minting vulnerability in a modified CW20-ICS20 token contract on Secret, stealing approximately $4.67 million. The attacker minted arbitrary Secret-wrapped Axelar assets on Secret by launching a new Cosmos chain (with only one validator) and self-relaying IBC packets to it. The contract did not verify which IBC channel the inbound tokens came from. The attacker exited through the Axelar bridge. The Axelar protocol was not compromised and prevented the spread of contagion to other chains.
app_icon
ChainCatcher Building the Web3 world with innovations.