Quick answer: Cross-chain bridges let assets move between separate blockchains, and they are one of the most attacked parts of crypto because a single flawed contract can mint tokens that are not backed by anything. The Secret Network CW20-ICS20 exploit is a clear case: a security analysis by Common Prefix traced a drain of roughly $4.67 million to two verification checks that had been commented out of a forked bridge contract, letting an attacker forge deposits and redeem real assets. Axelar’s core protocol and other chains were not affected, but the incident shows why bridge security matters as more regulated, tokenized assets move on-chain.
Updated 07/17/2026. By Jake Claver. Educational content, not investment advice.
Axelar and Secret Network sit in the plumbing of cross-chain finance. Axelar is an interoperability network that routes messages and assets between blockchains; Secret Network is a chain built around private, or encrypted, smart contracts. When people talk about “tokenization moving into regulated markets,” they usually mean assets being issued and settled on-chain. That vision depends on bridges, and bridges are where the money tends to leak. This piece walks through one documented failure and what it teaches, using the primary incident analysis as the anchor.
What a cross-chain bridge actually does
Blockchains do not natively talk to each other. A bridge is the connective layer that lets a token on one chain be represented on another. The common pattern is lock-and-mint: you lock an asset in a contract on the source chain, and the bridge mints a wrapped version on the destination chain. To reverse it, you burn or return the wrapped token and release the original. The standards world has spent decades making messaging between institutions verifiable; bridges are trying to do something similar between chains, but the security model is young and the code is often forked and modified.
The integrity of that model rests on one thing: the mint side must only create tokens that are genuinely backed by locked collateral on the source side. Break that link, and the bridge will happily print money out of nothing.
How the Secret Network bridge was drained
According to the incident analysis published by Common Prefix, the affected component was Secret Network’s modified CW20-ICS20 contract, a bridge that handled IBC transfers connecting Secret to Axelar. IBC is the inter-blockchain communication standard used across the Cosmos ecosystem. The contract was a fork of an earlier implementation, and in the fork two critical checks had been commented out:
- A denomination-trace check that would have validated that a token actually arrived through a legitimate channel, rather than trusting the token’s name.
- A channel-balance check that would have capped redemptions to the amount genuinely escrowed.
With those guards disabled, the contract minted wrapped tokens based on denomination names alone. The analysis describes the attacker opening a rogue IBC channel to the bridge (channel creation was permissionless), forging deposits whose names matched the bridge’s allow-list, minting unbacked tokens, and then redeeming them out to Axelar, which drained the real assets from the escrow account. Seven wrapped assets were affected, including wrapped USDT, USDC, DAI, WETH and WBTC. Common Prefix puts the total drained at about $4.67 million and notes the vulnerable code had been present since the repository’s initial commit. Axelar’s core protocol and the other connected chains were not compromised; the failure was in one forked, unaudited bridge contract.
Why bridges keep failing the same way
Two root causes in this case generalize to most bridge incidents. The first is an unaudited fork: security-relevant code was copied and altered, checks were removed, and the modified version was deployed without a fresh audit. The second is permissionless trust: anything that lets an unvetted party open a channel or register a token to a minting contract widens the attack surface. Bridge security is less about clever cryptography and more about invariants that must always hold. Every minted token maps to real locked collateral. Redemptions never exceed escrow. Only verified sources can trigger a mint. When one invariant is silently disabled, the whole thing becomes a faucet.
This is a familiar risk category, and general cybersecurity practice speaks to it directly. The NIST Cybersecurity Framework frames the job as identifying, protecting, detecting, responding and recovering, and the response and recovery steps are exactly what limited this incident: the Secret team halted and migrated the affected contract, and Axelar disabled the Secret-to-Axelar connection once the failed cross-chain transaction was spotted.
Why this matters for tokenized markets
Tokenization is the idea of representing real assets, from money-market fund shares to bonds, as programmable tokens that can settle on-chain. The Bank for International Settlements has argued in its work on tokenisation and the future monetary system that the appeal is atomic settlement: bundling the asset and the payment into a single simultaneous transaction so there is no gap where one side has delivered and the other has not. That only works if the venues holding those tokens are sound. If regulated assets are going to travel across chains, the bridges carrying them inherit institutional-grade expectations, and a $4.67 million object lesson in a wrapped-token bridge is a preview of the stakes.
Regulators are watching the broader category. The CFTC’s digital assets resources catalog the fraud and operational risks that come with moving value on new rails. None of that changes the underlying engineering lesson: a bridge is only as trustworthy as its weakest invariant, and forking security code without re-auditing it is how those invariants disappear without anyone noticing.
Common questions
What is a cross-chain bridge?
A cross-chain bridge is software that lets an asset on one blockchain be represented and used on another. The common design locks the original asset in a contract on the source chain and mints a wrapped version on the destination chain, reversing the process to redeem it.
What caused the Secret Network bridge exploit?
According to Common Prefix, two security checks were commented out of a forked CW20-ICS20 bridge contract: one that verified a token arrived through a legitimate channel, and one that capped redemptions to the escrowed amount. That let an attacker open a rogue channel, forge deposits, mint unbacked tokens, and drain roughly $4.67 million in real assets.
Was Axelar itself hacked?
No. The incident analysis states that Axelar’s core protocol and the other connected chains were not compromised. The failure was in one modified, unaudited bridge contract on the Secret side, and Axelar disabled the affected connection in response.
Why are bridges considered the weak point in crypto?
Bridges concentrate a lot of value behind minting logic that must perfectly track locked collateral. A single flawed or removed check can let the bridge create tokens with no backing, so one bug can drain the whole escrow. Forked, unaudited code and permissionless trust are recurring causes.
What does this mean for tokenized real-world assets?
As regulated assets move on-chain, the bridges that carry them between networks inherit institutional expectations for security and settlement. The lesson is that interoperability infrastructure needs audits, tight invariants, and monitoring, not just fast throughput.
This content is educational only. It is not tax, legal, or investment advice. Check primary sources and speak with a qualified professional before making financial decisions.
