An attacker exploited a years-old infinite-mint flaw in Secret Network's Axelar bridge contract, draining $4.67M in wrapped stablecoins and ETH over seven days before being detected.

Secret Network says about $770,000 of the stolen funds still sits in the attacker's Axelar wallet, and that Axelar declined its request to freeze it.

A smart contract bug on Secret Network let an attacker mint unbacked tokens and drain $4.67 million in Axelar-wrapped assets before moving funds to Ethereum.