Secret Network Hack

On June 10, 2026, an attacker drained about $4.67 million from the bridge that carried Axelar assets into Secret Network, and no one noticed for a week. The bug was in Secret Network's own bridge contract, a modified ICS-20 token contract, not in Axelar or IBC. When Secret moved that contract from an escrow model to a mint model, two functions that checked where a transfer came from, parse_voucher_denom() and reduce_channel_balance(), were removed. The contract only checked that an incoming token name was on its allowlist, not that the packet came from the real Axelar channel. Because anyone can open an IBC channel, the attacker set up a fake chain, sent forged deposits and minted unbacked saTokens (saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, sawstETH). They then redeemed the tokens through the real channel for assets held in Axelar's escrow.

Secret Network's default privacy hid the balances, so the theft only came to light on June 17, when a normal cross-chain transfer failed for lack of escrow funds. By then the attacker had moved the funds through Osmosis to Ethereum, swapped them for about 2,350 ETH on CoW Protocol, and spread them across about 30 fresh wallets, then to deposit addresses at KuCoin, ChangeNow and HitBTC. Axelar disabled its Secret connections, and Secret halted and migrated the contract. Axelar declined Secret's request to freeze funds still in the attacker's Axelar wallet, which were valued at about $642,000 (Rekt) or $672,000 (The Block). Nothing has been reported recovered.

**On-chain references (per Rekt)**

- Vulnerable contract (Secret): secret1yxjmepvyl2c25vnt53cr2dpn8amknwausxee83 - Attacker (Secret): secret154pdez8zazqh26wyuyu70nqraal3hkvf2f03vm - Attacker (Axelar): axelar1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdhl6ad8 - Attacker (Ethereum): 0x6c2eAB82bA2897A6E99FB6Af018020dA15123976