The crypto sector was shaken this weekend by a series of security incidents across three separate protocols. Secret Network’s Axelar bridge fell victim to a multimillion-dollar fake minting attack, Ethereum layer 2 network Taiko completely halted block production after an exploit, and DeFi protocol Altura was forced to liquidate its stablecoin vault following intense withdrawal demand.
Secret Network’s Axelar Bridge Exploited for $4.67 Million
A vulnerability in the IBC bridge contract connecting Secret Network to Axelar allowed the attacker to mint unbacked Secret-wrapped tokens. According to an analysis by Common Prefix, the attacker drained around $4.67 million through this method. The attack took place on June 10 but was not detected until June 17, when a failed cross-chain transfer revealed that an escrow account had been emptied.
Opening an IBC channel does not require permission, and the attacker used that feature to their advantage. They created a single-validator Cosmos chain, opened a channel to the bridge contract, and relayed fake packets that matched token definitions on the allowlist. Because the contract could not distinguish those packets from ones arriving through the real Axelar channel, it minted unbacked tokens. The flaw traces back to the contract’s original deployment in 2023, while a March 5 update carried over the same missing controls.
Axelar disabled the Secret and Secret-SNIP connections and said its own protocol was not affected. Around $672,000 of the stolen assets still remain in the attacker’s wallet. Secret Network requested that these assets be frozen, but Axelar decided not to pursue that request.
Taiko Halts Block Production After Attack
Ethereum-based rollup Taiko confirmed that its chain state validation mechanism had been compromised and told users to withdraw funds from all bridges on the network. All proposers suspended new block production during the investigation, and the team also asked exchanges to halt deposits for the native token.
Security firm Blockaid traced the issue to a flaw in Taiko bridge’s source-signal proof verification. Fake message proofs were accepted as valid on Ethereum mainnet without a corresponding real event on the source chain. This allowed the attacker to register fake bridge messages and withdraw assets from the ERC20 vault without authorization.
Blockaid estimated the loss at around $1 million, while PeckShield placed the figure closer to $1.7 million. The attacker also moved 1.99 million Taiko tokens, worth about $169,702, to an exchange.
Altura Liquidates Vault After “Unprecedented” Withdrawal Demand
DeFi protocol Altura announced that it had begun an orderly liquidation of its yield vault after a surge in withdrawal requests over the weekend. CEO Ranveer Arora said more than $8.5 million in instant redemptions had been processed over the past 24 hours. At its peak, the vault held $39 million in stablecoins allocated across strategies such as funding rate arbitrage, market making and real-world asset positions.
Arora said the protocol had no direct exposure but was affected by unfounded market narratives. This was a reference to the collapse of Main Street’s yield-bearing msUSD stablecoin, which lost more than 70% of its value. Main Street’s token plunged after proof provider Accountable terminated its service agreement with the protocol.
Accountable also provides a similar verification service to Altura. Although this partnership does not create a direct link between the two protocols, it fueled contagion fears across the market.
