An attacker exploited a modified IBC bridge contract connecting Axelar to Secret Network to mint unbacked Secret-wrapped tokens, then redeemed them for roughly $4.67 million in real tokens, according to a postmortem from Common Prefix.The June 10 attack went undetected for seven days, until a failed cross-chain transfer on June 17 exposed that the Axelar escrow account had been emptied.Axelar’s emergency committee disabled the Secret and Secret-SNIP connections and said its core protocol was never compromised.About $672,000 of the stolen funds still sits in the attacker’s Axelar wallet; Secret Network said that Axelar declined its request to freeze it.