Secret Network: $4.67M Stolen, and Nobody Noticed for Seven Days

At 15:39 universal time on Wednesday 17 June 2026, an ordinary transfer of bitcoin between two blockchains failed. The error said there was not enough wrapped bitcoin in the account to pay out. That account was supposed to hold the real coins behind every bitcoin token on Secret Network, a blockchain whose whole selling point is privacy. Within 20 minutes engineers found it nearly empty.

It had been emptied a week earlier. On the evening of 10 June, in about 35 minutes, a thief had created millions of dollars of fake tokens on Secret Network and swapped them for real ones. The total was about $4.67 million: roughly $1.54 million in ether, $1.12 million in the digital dollar USDT, $1.07 million in bitcoin, $638,000 in USDC, and smaller amounts of DAI, BNB and staked ether.

Nobody noticed for seven days. On a chain built so that nobody can see anyone else's balance, that was partly the design working as intended.

A private chain with a public back door

Secret Network launched in 2020 as a "layer 1", a blockchain in its own right rather than an app built on someone else's. Its main developer was SCRT Labs, the company founded by Guy Zyskind. Its native coin is SCRT. Its pitch is that balances and transactions are encrypted by default, the way a Swiss bank account was once supposed to be private.

Secret belongs to the Cosmos family, a group of independent blockchains that talk to each other through a shared messaging standard called IBC (Inter-Blockchain Communication). Through that standard it connected to Axelar, a bridge network. A bridge is a service that moves assets between blockchains. Because a coin cannot literally leave its home chain, a bridge locks the real coin in a vault, called escrow, and issues a matching token on the other side, like a cloakroom ticket for a coat. On Secret those tickets were called saTokens: saUSDT, saUSDC, saWETH, saWBTC and so on. Each one was meant to be backed one for one by a real coin in Axelar's escrow.

One check, switched off

The contract that issued those tickets on Secret was a modified version of a standard piece of Cosmos code known as CW20-ICS20. Common Prefix, a blockchain research firm that traced the theft, found that two safety checks in it had been commented out, meaning the lines were still in the file but switched off. One checked which channel, or delivery route, an incoming deposit had come down. The other limited payouts on each route to what had actually been deposited on it.

Without them, the contract only asked whether a token was on its approved list. It never asked where the deposit came from. A "USDT has arrived" message from a stranger looked exactly like one from Axelar.

So the thief built their own. On 10 June they spent most of the day setting up and testing, then at 19:01 created a fake blockchain run by a single computer, opened a new route from it to Secret's contract, and sent seven forged deposit messages, each sized to the whole existing supply of one saToken. The contract issued genuine saTokens against nothing. Between 19:33 and 19:36 the thief sent those tokens back to Axelar down the real route, and Axelar, seeing valid tickets, released the real coins from escrow.

Common Prefix traced the flaw to the contract's first version in early 2023. A software update on 5 March 2026 carried it forward. The code sat in SCRT Labs' public library on GitHub.

Why a week went by

Secret's privacy hid one half of the theft. The fake saTokens sat in encrypted balances that outsiders could not see. The other half, the empty escrow, was on Axelar, where balances are public. Nobody was watching it.

The two sides have since blamed each other. Secret Network's own incident report, posted by its team on 19 June, said "no external audit was requested by Axelar as part of the integration" and that no monitoring, alarm or emergency pause was triggered on the Axelar side. Axelar replied on X that "neither Axelar nor IBC was compromised" and that the exploited contract "was not developed, deployed, or maintained by Axelar". Common Prefix's report said the modified contract had changed how much it trusted incoming messages, so the original audit no longer applied, and it "shipped to mainnet without re-audit".

By the time anyone looked, the money was long gone. The thief moved the coins off Axelar through Osmosis, a Cosmos trading venue, then to Ethereum, swapped nearly everything into about 2,350 ether on CoW Protocol, split it across about 30 new wallets and deposited it at the exchanges KuCoin (1,199 ether), ChangeNow (1,050 ether) and HitBTC (100 ether). Axelar said it was working with exchanges and law enforcement.

The money that stayed put

Not all of it left. Some of the haul, 239,324 USDC, 6.2 wrapped bitcoin, 64 BNB and 249 AXL, was still sitting in the thief's wallet on Axelar. Secret valued it at about $770,000; The Block, at prices a day later, put it at about $672,000. Secret asked Axelar to freeze it, and said Axelar had "decided not to pursue" the request.

Axelar's community then voted. Proposal 490, a non-binding "signaling" motion to freeze the stolen funds and later hand them to a trusted distributor for return to victims, passed on 5 July with almost no opposition. No binding follow-up was ever put to a vote. As of 16 October 2026 the same four balances are still in the same wallet, untouched. No arrest or charge has been reported, and holders of saTokens on Secret were told plainly that their "funds may be lost".

What happened to Secret Network

The bridge theft did not touch SCRT itself, but it changed the chain's future. On 7 July SCRT Labs proposed abandoning Secret's own blockchain and moving SCRT to Arbitrum, a network that runs on top of Ethereum. It cited the exploit and warned that "old code is becoming dramatically easier to analyze" with AI tools. SCRT fell about 24% the next day, to roughly 4 cents, more than 99% below its 2021 peak. SCRT Labs said it would end its support for the chain on 1 September whatever the vote decided.

Holders rejected the Arbitrum plan. Instead they backed Proposal 365, a "community continuance" drafted by Lisa Loud, who had led the Secret Network Foundation, which passed on 19 August. It kept the chain running under new stewardship, paid for by printing 1.079 billion new SCRT on 21 August, cutting existing holders to about a quarter of the supply. The plan set aside a pool for "remediation" of hack victims. How much of it reaches the people left holding unbacked saTokens, and when, has not been published.