Back Kucoin

Axelar Network Responds to Security Incident, Vulnerability Traced to Third

Kucoin • June 20, 2026

The Axelar Network release note states that neither the Axelar Network nor the IBC protocol was compromised. The affected token smart contracts were not developed, deployed, or maintained by Axelar Network. The exploited contract was a forked version of CW20-ICS20, in which developers removed two critical security checks, resulting in an "infinite minting" vulnerability. This fork altered the original trust model of the contract and was not subjected to a security audit. Axelar Network emphasizes that this incident was not due to a specific logical flaw or an issue with the IBC protocol, but rather a security risk introduced by third-party modifications to the contract.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Axelar Bridge Exploit Results in $4.67 Million Loss Linked to Secret Network On June 19, 2026, Axelar Network reported a security incident where approximately $4.67 million worth of tokens were drained from the Secret Network due to an exploit in a modified ICS-20 smart contract. The attacker exploited vulnerabilities in the contract that failed to verify token transfers from an authentic Axelar-controlled IBC channel. This incident specifically affected bridged assets from Axelar to Secret Network, including wrapped USDT, USDC, DAI, WETH, WBTC, WBNB, and wstETH. Axelar's core protocol and other IBC connections remained unaffected. In response, Axelar disabled the affected bridge connections and initiated an investigation while contacting law enforcement and exchanges. The vulnerability was traced back to a lack of critical security checks in the contract, which allowed for the creation of unbacked wrapped tokens. A full post-mortem is expected to provide further insights into the incident. 16 sources 66

Extracted Entities

Axelar Network Responds to Security Incident, Vulnerability Traced to Third

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (2)