Secret Network ICS-20 smart contract exploited for $4.67 million, with Axelar bridge connections disabled

Attackers exploited a vulnerability in the Secret Network ICS-20 smart contract and stole $4.67 million in assets, according to analysts at Common Prefix. For PSPs and crypto payment operators, the important bit is that the hit landed on the Axelar–Secret bridge channel, not on the core Axelar protocol.

1. Common Prefix said the compromised path was the interaction channel between Secret Network and Axelar, which is used to move funds between the two ecosystems. Blockchain monitoring systems first flagged unusual activity through the Axelar–Secret bridge, and once the incident was confirmed, the Axelar team disabled the affected connections to stop further outflows.
2. Axelar said the attack did not affect its main protocol or other cross-chain channels. Secret Network said only assets that came in through the Axelar bridge were compromised, while the network’s native tokens were not touched and other connections continued to operate normally.
3. After the breach was detected, both teams contacted cryptocurrency exchanges and law enforcement to track the stolen funds. Axelar said it will publish a detailed technical report after the investigation is completed.
4. Common Prefix said the incident was harder to spot because Secret Network is built around user privacy: transaction and balance data are encrypted, so the attack was not detected immediately. Their estimate is that the attackers stayed unnoticed for about nine days, which gave them time to move part of the stolen assets.
5. For context, the same source noted a separate breach at Humanity Protocol, a project that identifies users by palm print, with losses estimated at about $32 million.