Solana news: Secret Network’s Axelar Bridge Exploit Highlights Cross-Chain Security Risks
Overview of the Exploit
Secret Network’s Axelar bridge suffered a $4.67 million loss due to an infinite-mint exploit that went undetected for seven days. The attacker exploited a flaw in a custom token contract, allowing the creation of unbacked tokens, which were then redeemed for real assets.
How the Attack Occurred
The vulnerability stemmed from a modified CW20-ICS20 contract on Secret Network, which failed to verify the source channel of inbound transfers. This allowed the attacker to forge deposits and mint genuine saTokens without collateral. The attacker created a single-validator Cosmos chain to open a channel and relay forged packets, bypassing standard checks.
- Seven saTokens were affected: saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH.
- The flaw existed since early 2023 and persisted through a March 2026 contract migration.
- The exploit was only discovered after a failed cross-chain transfer revealed missing collateral.
Response and Aftermath
Axelar’s emergency committee disabled the affected connections, and cross-chain router Squid removed Secret from its frontend. The attacker routed stolen assets through Osmosis and Ethereum, ultimately swapping them for ether. Some funds remain flagged as recoverable, but no timeline for restoration has been provided.
Why This Matters for Solana and the UK
Cross-chain bridges are critical for interoperability in the blockchain ecosystem, including Solana. This incident highlights the ongoing risks associated with bridge contracts and the need for rigorous security audits. UK users and developers engaging in cross-chain DeFi must remain vigilant, as similar vulnerabilities could impact Solana-based assets or services. Regulatory scrutiny in the UK may increase as such exploits become more frequent, affecting trust and adoption.
Lessons for the Ecosystem
- Importance of external audits for bridge contracts.
- Need for effective monitoring and emergency response mechanisms.
- Ongoing vigilance required for cross-chain DeFi participants, including those in the UK and Solana communities.
