Axelar Clarifies Security Incident: Third-Party Minting Flaw Exposed

The cross-chain communication protocol Axelar Network has released an official statement addressing a recent security breach, clarifying that the underlying infrastructure remained secure throughout the event. Contrary to initial market speculation, the Inter-Blockchain Communication (IBC) protocol was not compromised. Instead, the exploit originated from a vulnerability in a specific third-party token smart contract, which allowed for an "infinite minting" loophole that impacted local liquidity pools.

Root Cause of the CW20-ICS20 Contract Exploit

The investigation revealed that the vulnerability existed within a forked version of the CW20-ICS20 contract. While the original codebase contains robust security measures, the developers of this specific fork reportedly removed two core security checks during the implementation process. This modification fundamentally altered the contract's trust model, creating a bypass that malicious actors exploited to generate an unlimited supply of tokens.

• The affected contract was not developed or maintained by the Axelar core team.
• Deletion of original validation mechanisms led to the unauthorized minting capability.
• The modified codebase did not undergo new security audits prior to its deployment.

Permissionless Deployment and Ecosystem Security

Axelar Network emphasized that its architecture is permissionless, meaning any developer can deploy contracts for cross-chain asset wrapping via IBC. This flexibility is a hallmark of decentralized finance (DeFi), but it also places the responsibility for smart contract integrity on the individual project deployers. Similar wrapping contracts are frequently utilized to bridge assets from various blockchains to the Cosmos ecosystem and other networks.

Axelar Network itself and the IBC protocol were not attacked or compromised. The affected token smart contract was not developed, deployed, or maintained by Axelar Network.

The incident highlights the ongoing risks associated with unaudited code forks in the interoperability sector. As the industry moves toward more complex cross-chain interactions involving Cosmos-based chains and the Ethereum Virtual Machine (EVM), the Axelar team urges developers to adhere to established security standards. This event serves as a reminder for liquidity providers and users to verify the audit status of third-party wrappers before engaging with bridged assets.