TL;DR
- On June 10, 2026, an attacker exploited the Axelar<>Secret bridge
ics20-for-axelarcontract used for assets bridged from Axelar to Secret, creating ~$4.67M of unbacked tokens out of thin air. The Secret team was informed about the incident by the Axelar team on June 17. - The entry point was a latent bug in the ics20-for-axelar contract - the open-source component that integrates the Axelar bridge into Secret, in service since early 2023. The attacker forged deposits from a counterfeit chain to make it mint unbacked tokens that had no value on their own.
- The loss itself happened on the Axelar side, where the real assets were custodied in escrow. Redeeming the forged tokens through the legitimate channel released that channel’s entire reserve - automatically, to a single attacker wallet, in roughly 18 minutes. No effective monitoring, anomaly-detection, or emergency pause mechanisms were triggered within the Axelar bridge infrastructure to identify and temporarily halt unusually large or suspicious transfers before the bridge assets were substantially drained from Axelar.
- From that single wallet on Axelar, the proceeds were bridged onward to Ethereum and BSC and cashed out, mainly through ChangeNOW and KuCoin.
- Part of the stolen funds ( ~$770K ) are still in the attacker’s wallet on the Axelar chain. We have asked the Axelar team to take action to freeze those funds or work with their community to do so to ensure no further financial losses occur, a request they have decided not to pursue.
- Other than Axelar-bridged assets, Secret Network’s core protocol, its privacy features, native SCRT and SNIP-20 tokens, and all other IBC connections - including the Noble USDC bridge - are fully unaffected. Axelar’s core protocol is likewise not affected.
- Bridging through Axelar has been disabled, the Axelar connection has been paused, and together with Axelar we’ve engaged the relevant exchanges and law enforcement with a full transaction trace.
What happened
A “bridge” lets a token from one chain be represented on another. On Secret, assets coming from Axelar are represented as SNIP-20 tokens (saUSDT, saUSDC, saWETH, saWBTC, saDAI, saWBNB, saWstETH). A smart contract on Secret is supposed to create (mint) those tokens only when the matching real asset is genuinely deposited from Axelar.
On June 10, an attacker found that this contract would mint without verifying where the deposit came from. They created their own fake blockchain, connected it to the contract, and sent seven fake “deposit” messages. The contract minted seven different tokens - about $4.67M worth - directly to the attacker, with nothing backing them.
How the exploit worked (in plain terms)
Opening an IBC channel is permissionless - normal and by design across the Cosmos ecosystem, where anyone can connect a chain without a governance vote. Security in a setup like this therefore has to hold at two layers, and in this incident both had gaps:
- The receiving contract has to verify the source. Because anyone can open a channel, the contract receiving transfers has to confirm that a deposit truly came from the genuine Axelar chain. The Secret-side contract checked only “is this a token I’m allowed to issue?” - not “did this come from the real Axelar chain?” - so a message from a counterfeit chain naming a real asset (e.g. “USDT”) was treated as a genuine deposit and minted.
- The bridge releasing the real assets has to catch abnormal activity. The genuine reserves were held in escrow on the Axelar side and paid out on redemption. When the forged tokens were redeemed back through the legitimate channel - as ordinary, valid IBC transfers - the bridge released that channel’s entire reserve to a single wallet within minutes, with nothing flagging or halting the drain.
Putting it together: the attacker spun up a counterfeit chain, opened a channel to the contract, and minted. They then redeemed the fake tokens back through the legitimate Axelar bridge - which released real reserves - and bridged the proceeds onward.
Detailed Analysis of the Vulnerability
The exploit occurred in the ics20-for-axelar contract (code ID 2446). The contract, which serves as the Secret side of the Axelar<>Secret IBC connection (secret1yxjmepvyl2c25vnt53cr2dpn8amknwausxee83, IBC port wasm.secret1yxj…/channel-61), is a fork of the upstream snip20-ics20, which is an escrow-based contract implementing ICS-20. It locks SNIP-20s when sending out, and on receipt releases balances previously escrowed against that channel.
The contract was repurposed to support the Axelar Bridge by minting “Secret Axelar” SNIP-20 tokens (saUSDC, saUSDT, …) on receipt, so that assets bridged from Axelar are issued as SNIP-20 tokens on Secret Network.
Background and Deployment History
This bridge dates to the original Axelar-Secret integration, established under the partnership Axelar announced on July 13, 2022 (“Axelar Network Integrates with Secret Network …”).
The contract was first instantiated on 2023-03-30 13:00 UTC, block 8152995 on Secret Network.
The relevant code path dates back to the codebase’s initial commit (Jan 15, 2023); the version running at the time of the incident - code ID 2446, the add-migration-message branch (b206182) - reached production through a routine contract migration on March 5, 2026 (block 24,186,627). The behavior described below is therefore long-standing rather than newly introduced.
The adaptation of snip20-ics20 for Axelar bridge use case
The Axelar integration is fundamentally different from the original snip20-ics20 contract - tokens flow inward from an external chain rather than outward from Secret - the contract needed to be adapted with a mint/burn mechanism instead of the lock/redeem (or: escrow) one.
Specifically, in do_ibc_packet_receive(..) - the exploited function - two functions were removed as they were no longer fitting: parse_voucher_denom(..) and reduce_channel_balance(..). Also, the “transfer()” logic (i.e. redeem) was replaced with “mint()” logic.
Both functions were artifacts of the upstream escrow model and were incompatible with what the Axelar integration required - the contract had to accept bare, Axelar-origin denoms and mint against them, which parse_voucher_denom (built for returning Secret-origin vouchers) would reject, while reduce_channel_balance tracks Secret-side escrow that a minting contract never holds in the first place. Removing them was therefore necessary. Instead, an “Allow List” of supported tokens was introduced.
The two removed functions included an implicit authentication of the source of tokens (or: channel_id), which did not transfer to the new Allow List, and thus the source of tokens was never authenticated.
It should be noted that no external audit was requested by Axelar as part of the integration.
What was affected - and what wasn’t
Affected: only the aforementioned ICS-20 contract, and the Axelar-bridged saXXX tokens it issues. Because the attacker redeemed through the real bridge, the genuine reserves backing legitimately-bridged saXXX were drained on Axelar - so existing saXXX balances should be treated as impaired/under-collateralized.
Not affected:
- All other IBC connections from Secret Network, including the native Noble USDC bridge, which we verified remains fully backed (1:1, escrow matches supply).
- Native Secret tokens (SCRT) and SNIP-20 tokens that aren’t Axelar-bridged. The separate “SNIP-20 over IBC” bridges use a different, escrow-based design that cannot mint and are unaffected.
- No other Axelar integrations are impacted.
Where the funds went
We have a complete, end-to-end on-chain trace:
- Mint on Secret - 7 unbacked tokens minted to the attacker (~$4.67M), in a ~6-minute window.
- Redeem through the real Axelar bridge - ~18 minutes later, the attacker pushed the full amounts back out to a single Axelar wallet, draining the genuine reserves.
- Move out via Osmosis - the funds were forwarded through Osmosis (using packet-forwarding) onward to Ethereum and BSC.
- Cash out - on Ethereum the assets were swapped to ~2,349 ETH and dispersed through 30 intermediary wallets into ChangeNOW (~1,050 ETH), KuCoin (~1,029 ETH), and HitBTC (~100 ETH); the BSC leg (~106 BNB) was routed to ChangeNOW as well. At the time of writing, a residual (~$770K) remains on the attacker’s Axelar wallet.
(The attacker also scattered fake “look-alike” tokens with Unicode symbols imitating ETH/BNB to clutter the trail - these carry no value and we’ve excluded them from the trace.)
What we’ve done
- Disabled bridging on tunnel.scrt.network.
- Axelar paused the Secret and Secret-SNIP connections.
- Engaged the relevant exchanges and law enforcement with the full transaction trail.
- Identified remaining assets on Axelar that could be saved and petitioned Axelar to take action.
- Prepared a detailed internal incident report and forensic fund-trace.
What this means for you
- If you hold Axelar-bridged saXXX tokens on Secret, please be aware their backing was affected and your funds may be lost.
- Do not bridge via the Axelar<>Secret bridge until further notice; the front-end is disabled.
- SCRT and non-Axelar SNIP-20 tokens are not affected - no action needed there
Key on-chain references:
- Affected contract (Secret): secret1yxjmepvyl2c25vnt53cr2dpn8amknwausxee83
- Attacker addresses: Secret secret154pdez8zazqh26wyuyu70nqraal3hkvf2f03vm · Axelar axelar1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdhl6ad8 · Ethereum 0x6c2eab82ba2897a6e99fb6af018020da15123976
- First fraudulent mint (saUSDT): Secret tx 01526FA5A35AB071ABF66F8F3F3F390EA62356EA2CF8B54B219F5DE974532DE6
Appendix - Full list of transactions:
Section 1 - Fraudulent minting transactions (Secret Network)
| # | Asset | Secret tx hash | Time (UTC) | Packet denom | Amount minted | saXXX token contract |
|---|---|---|---|---|---|---|
| 1 | saUSDT | 01526FA5A35AB071ABF66F8F3F3F390EA62356EA2CF8B54B219F5DE974532DE6 |
19:14:05 | uusdt |
1,121,270.052077 | secret1wk5j2cntwg2fgklf0uta3tlkvt87alfj7kepuw |
| 2 | saUSDC | DC4529F30175A7FAEF332FEEE86A5FE1F4D9DE56B144A549CCE620E64039BB42 |
19:15:07 | uusdc |
638,198.653186 | secret1vkq022x4q8t8kx9de3r84u669l65xnwf2lg3e6 |
| 3 | saWETH | 4A0CC8681376AEA9E52C5812E661F880B207061799E6CF84D50B7FDD4C9283A0 |
19:16:14 | weth-wei |
893.468984 | secret139qfh3nmuzfgwsx2npnmnjl4hrvj3xq5rmq8a0 |
| 4 | saWBTC | AE894827FEA3421DCA4F593765D5C7B7602C8CBF5E2994894F031BD13C4BC351 |
19:17:05 | wbtc-satoshi |
16.536059 | secret1guyayjwg5f84daaxl7w84skd8naxvq8vz9upqx |
| 5 | saDAI | 46AEC0D51571338AA0ECE204CD963BD9576E3F1193D0E5222517C5813ADB2DFB |
19:18:06 | dai-wei |
174,536.475914 | secret1c2prkwd8e6ratk42l4vrnwz34knfju6hmp7mg7 |
| 6 | saWBNB | 872D4FFCFDD34B5396E494E32CF59ED4D15E04690DDA69EC601414C585ED1313 |
19:19:02 | wbnb-wei |
170.764596 | secret19xsac2kstky8nhgvvz257uszt44g0cu6ycd5e4 |
| 7 | saWstETH | 44F1987A795B2871F7D49F1F21D76507D60C89AD8E35C9BF67683A84A797640E |
19:20:09 | wsteth-wei |
17.656075 | secret148jzxkagwe0xulf8jt3sw4nuh2shdh788z3gyd |
Section 2 - Transfers from Secret to Axelar through the bridge
| # | Asset | Amount | Secret tx (send_packet) | Matching Axelar tx (recv_packet) | Axelar time (UTC) |
|---|---|---|---|---|---|
| 1 | uusdt | 1,121,270.052077 | E17184D49A12B594CEB66696F380598E83C2E716F5F10002291B8DA1C2B1BFA1 |
C03B1FE0EEF40EB3765A6FD93F26FF1CCAF10B569C18B15A0D57B4324D8C2EC3 |
19:34:29 |
| 2 | uusdc | 638,198.653186 | 842CCB7514F4F7527E10C590C32526DDF4CFBC3CCA099B3B5EE14901AB5B3A18 |
C03B1FE0EEF40EB3765A6FD93F26FF1CCAF10B569C18B15A0D57B4324D8C2EC3 |
19:34:29 |
| 3 | weth-wei | 893.468984 | 45C2E2853A3DEBC558DFDB5E0316F79B6D3122A2EB0455059FD4744F7E857B64 |
C03B1FE0EEF40EB3765A6FD93F26FF1CCAF10B569C18B15A0D57B4324D8C2EC3 |
19:34:29 |
| 4 | wbtc-satoshi | 16.536059 | D0BF6C27028D574591DFC25E4D68E0889BE41727265489752F35DBBBF702C3C2 |
22BE928EBFCCF578E4F703C2EF7822FBDD5B543D94F677B7FD82B78B8E74C1D9 |
19:35:12 |
| 5 | dai-wei | 174,536.475914 | DD2993CC68D8C7D2B4D0B209EC7AA5CE34F71ADFA6779010F39072360CCF46FE |
4A2A0D419B2F9C3BEDE6EEE9918C59AE7F04EF36080BC486D003394BE8083470 |
19:36:45 |
| 6 | wbnb-wei | 170.764596 | 22ABA9D6565A38293F0EADD94A64B71331EAF6F738A5A449D3FA070B4ABBBFCF |
4A2A0D419B2F9C3BEDE6EEE9918C59AE7F04EF36080BC486D003394BE8083470 |
19:36:45 |
| 7 | wsteth-wei | 17.656075 | 86B7F03213E6D2272768742A36BBE1AD4A8A54311980D768D0721AE0CDF7D05F |
4A2A0D419B2F9C3BEDE6EEE9918C59AE7F04EF36080BC486D003394BE8083470 |
19:36:45 |
All 7 redemptions named the same receiver, so the entire proceeds landed in a single Axelar wallet - axelar1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdhl6ad8:
| Asset | Amount credited to axelar1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdhl6ad8 |
|---|---|
| uusdt | 1,121,270.052077 |
| uusdc | 638,198.653186 |
| weth-wei | 893.468984 |
| wbtc-satoshi | 16.536059 |
| dai-wei | 174,536.475914 |
| wbnb-wei | 170.764596 |
| wsteth-wei | 17.656075 |
This wallet is the staging point for the onward exfiltration in Section 3. It also still holds the residual amounts not yet moved onward (≈239,324 uusdc, 6.20 wbtc-satoshi, 64.04 wbnb-wei, 248.85 uaxl as of this report, total value of approximately $770K at the time of writing).
Section 3 - Onward transfers from Axelar (all via Osmosis)
From the staging wallet axelar1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdhl6ad8, the attacker moved the funds out of Axelar in 18 IBC transfers, all on 2026-06-10. Every one went to Osmosis - there were no direct Axelar>Ethereum gateway transfers and no other destination chains out of Axelar. Each transfer:
| # | Axelar tx hash | Asset | Amount | > Osmosis receiver | Final dest (in memo) |
|---|---|---|---|---|---|
| 1 | C6F4F590B36EFF5FDCDE8996D9270AC3EE2DA243A3AC88E0F152FC074F9EB0FB |
weth-wei | 223.367246 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 2 | AB74CDDEC6E547627CA31E9E085DDAEA9EF1CBD06682C0F5188346F3487EF291 |
uusdt | 280,317.513019 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 3 | D0EF03112D07A2D7D467B95B240148E8502AE7C3776BAC8C71F5DFBD2FF13AFF |
wbtc-satoshi | 4.13401485 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 4 | BE8F0F138C26FAA4340E87C3DA9E599C25991B59A4E79AC94AC0D7B789E7BF36 |
uusdc | 159,549.663296 | osmo10a3k4hvk37cc4hnxctw4p95fhscd2z6h2rmx0aukc6rm8u9qqx9smfsh7u (swap contract) |
Osmosis swap |
| 5 | B0DF7FE26479CB3A72E3BF7F954CA7F39D559BA1D12D937E5EA6AFF937DE588C |
dai-wei | 43,634.118978 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 6 | 7EA8439FB1C089D7C87E9F84053F52DC9DA43DBA340B46405917D9239D9AE008 |
wbnb-wei | 42.691149 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
BSC 0x43d090025aAA6C8693B71952B910AC55CcB56bBb |
| 7 | 8B384A980A0038BBE8D159DBC0CE28749EB6D8A3C471CD38EA70D92449D18BED |
wsteth-wei | 4.414019 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 8 | 4D92E8867B55FE55DA79379476FCBF2F10DB66226238B5118F038A741CD0E49C |
weth-wei | 335.050869 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 9 | 86767670D765120713C065EEEBEABD4E40CE1428AAE41B6280925BCDA54EC5CA |
uusdt | 420,476.269529 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 10 | D34C67143EA1F9F9AF692755BDC926ED9575067ACA1B12992853EC1B613BC80E |
wbtc-satoshi | 6.20102229 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 11 | 7E56A1151FE5185CC3F708D210BA41E4D1752A8278DA9AC74FE6B3B0853EC383 |
uusdc | 239,324.494945 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 12 | 8FB1F586CDB9AC202E1D00F8E1AB7F53BF582EFD65E3F5218EEF71A61A17C41C |
dai-wei | 65,451.178468 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 13 | 53382B689982A38D7D8884FF8B854AFABB9F71F0F15BBA755E07A13326868229 |
wbnb-wei | 64.036724 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
BSC 0x43d090025aAA6C8693B71952B910AC55CcB56bBb |
| 14 | 998EEDA7ABF25684B658EDE19C8A9BEF246CF0EB71C2EFD3A8B7708668FB80FC |
wsteth-wei | 6.621028 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 15 | 5F3B02D6B10CD07AD12FB0673D8B07E4FE3DD0A0290FFDE76874C36A4C7370C0 |
weth-wei | 335.050869 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 16 | 56CA93E0E1D71CB831CE08D9E33AAB53FA74262CC0B4A637B46149FE001188E3 |
uusdt | 420,476.269529 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 17 | E65C67D63A5D94B096D06FFC1EC5522ACC1C2BB40264F64F852A0FC6D224D8BC |
dai-wei | 65,451.178468 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
| 18 | 55BA01EF12FA33670FE16D7E563D184D752C7A87889BA6BA8B17346CA4B7C6E7 |
wsteth-wei | 6.621028 | osmo1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdm2l9s5 |
Ethereum 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E |
Notes:
- The amounts forwarded are split into multiple tranches and exceed the single redeemed amount for several assets (e.g. WETH appears at 223.37 + 335.05 + 335.05; USDT at 280,317 + 420,476 + 420,476). This is consistent with the attacker recombining the redeemed proceeds with other balances already held on the Axelar wallet and forwarding in batches; the residual left behind (≈239k uusdc, 6.2 wbtc, 64 wbnb, 248 axl) is the un-forwarded remainder.
- Tx #4 (uusdc 159,549.66) was sent to an Osmosis CosmWasm swap contract (
osmo10a3k4hvk37cc4hnxctw4p95fhscd2z6h2rmx0aukc6rm8u9qqx9smfsh7u) rather than the simple forward - i.e. swapped on Osmosis before/instead of being forwarded onward. - The final EVM recipients embedded in the forward memos are
0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E(Ethereum) and0x43d090025aAA6C8693B71952B910AC55CcB56bBb(BSC, for WBNB). These are the entry points for the Ethereum-side trace in Section 4.
Section 4 - Ethereum / BSC destination and cash-out
The Osmosis forwards (Section 3) were delivered to the EVM chains via Axelar GMP. The funds were consolidated into ETH, then cashed out primarily through ChangeNOW (a non-KYC instant-swap service) and KuCoin.
4.1 Arrival on Ethereum
All six Ethereum-bound assets were delivered on 2026-06-10, 19:39-19:58 UTC, to the attacker’s Ethereum EOA 0x6c2eab82ba2897a6e99fb6af018020da15123976. Delivery was via the Axelar GMP execution path:
Axelar gateway 0x4f4495243837681061c4743b74b3eedf548d56a5 (contract) > GMP executor/router 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E (contract, pass-through) > 0x6c2eab82ba2897a6e99fb6af018020da15123976 (attacker EOA).
The router 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E received each token and forwarded it to 0x6c2eab82ba2897a6e99fb6af018020da15123976 in the same transaction (it is a shared service contract; unrelated traffic also flows through it). Amounts received at 0x6c2eab82ba2897a6e99fb6af018020da15123976 (net of bridge fees), matching Section 3:
The 16 inbound deliveries to 0x6c2eab82ba2897a6e99fb6af018020da15123976 (chronological, full transaction hashes), matching Section 3:
| # | Time (UTC) | Asset | Amount | Delivery transaction hash |
|---|---|---|---|---|
| 1 | 19:39:47 | WETH | 223.367 | 0x3513509c71bc8e02695fad55e136b8f21933f6a4433f4dafe471800d98ca8e05 |
| 2 | 19:45:11 | WBTC | 4.134 | 0xe49353d3a2b87d2f8ffaea85f26452d379ab186542b0bfeb552d5659efdf8967 |
| 3 | 19:45:11 | DAI | 43,633.36 | 0xde42dd558e9ccd70978c20529afacf0a94565d04aa798d1e38c32b4959d73343 |
| 4 | 19:45:11 | USDT | 280,316.74 | 0x5abb7ce7f64c360372a5b5b069b748d83f2a3b08780d15a72e430fc31e899025 |
| 5 | 19:45:47 | USDC | 159,549.57¹ | 0x7039eba2d324b57b493abb0cbba2bc41fce38a7587b076be089270f7cd582cff |
| 6 | 19:45:59 | wstETH | 4.4135 | 0xbc3bde340b83ed81105b4b630862a837174e9ff33b42e9cf2df08007e05661da |
| 7 | 19:50:59 | WETH | 335.050 | 0xc5cff1139dd881f58da1cc2e80ca1c53295f3a06222d406f0377caea004d0d5e |
| 8 | 19:51:47 | USDT | 420,475.34 | 0xae231983bff05a0361a876287ae050698edab3fc02d2a8dcbce4972b1b0f6225 |
| 9 | 19:51:47 | WBTC | 6.201 | 0x5b11120877276e8fb493c420f22776fa19c20e7e1376ab338c0533969606bf0b |
| 10 | 19:51:47 | USDC | 239,323.54 | 0xd0fc7d5699d2a545d54f96d8360ebfb439da3d922c4b21a34048f7eeee8b2317 |
| 11 | 19:51:47 | DAI | 65,450.19 | 0x2cbd4a70125f5200855e0d2c0071ffea9988d1f7e9b91b1819eaef25f34ae2e6 |
| 12 | 19:52:59 | wstETH | 6.6204 | 0xf05277c58cb0e048b7ce49c2ed4351ab62f5e2c2cc2c698fc8746acf179c7593 |
| 13 | 19:56:59 | USDT | 420,475.32 | 0x20d9cfdc9a00be26a175b9ae9c9f9dff873954fd549a5a03106274221cd298bb |
| 14 | 19:57:11 | WETH | 335.050 | 0xe40f58d2aa10d8e4aa4e8d577a51384aeff43ddec572a520ef6290502cc7133e |
| 15 | 19:57:59 | wstETH | 6.6204 | 0x08db0a3cab5e99bd06d2968888b92833905ac034933ec19fe6f6b04c97a2ee3f |
| 16 | 19:57:59 | DAI | 65,450.22 | 0x78028bf177d20b5ecd0ed1eb7e517ee8d4d2404f1d854ba599b89d6a98d0396d |
¹ The 159,549 USDC (row 5) is the Osmosis-swap leg (Section 3 tx #4); it was delivered to 0x6c2eab82ba2897a6e99fb6af018020da15123976 minted from 0x0000000000000000000000000000000000000000 (the Axelar GMP gateway) rather than through the 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E router. The other 15 arrived via the router 0xB773bCc5B325ad9AC6B36e1A046AD4466833A16E from gateway 0x4f4495243837681061c4743b74b3eedf548d56a5.
4.2 Consolidation into ETH (CoW Protocol)
Between 20:06 and 20:14 UTC the attacker swapped the stablecoins and tokens into ETH using CoW Protocol (settlement contract 0x9008d19f58aabd9ed0d60971565aa8510560ab41) - e.g. 1,121,267 USDT > 689 WETH, 398,873 USDC > 245 WETH, 174,533 DAI > 107 WETH, 10.3 WBTC > 392 WETH, 17.65 wstETH > 21.8 WETH. Net consolidated position: ≈2,349 ETH.
4.3 Dispersal and cash-out (Ethereum)
From 20:51 UTC (2026-06-10) through 09:19 UTC (2026-06-11), 0x6c2eab82ba2897a6e99fb6af018020da15123976 sent the ETH out in 30 native-ETH transfers of 50-139 ETH each to 30 deposit-style addresses (many vanity-prefixed - e.g. prefixes 0x67e, 0x517, 0xc3e, 0xdac, 0xf4f, 0x8ec; all 30 are listed in full in the per-transaction table below). Those addresses forwarded onward, converging on the exchange wallets below:
Resolving every second-hop destination accounts for all 2,349 ETH and identifies three exchanges - ChangeNOW, KuCoin, and HitBTC:
| Exchange / destination | Address(es) (Etherscan label) | ETH | # of the 30 addrs |
|---|---|---|---|
| ChangeNOW | 0xeba88149813bec1cccccfdb0dacefaaa5de94cb1 (ChangeNOW 16) |
≈1,050 | 13 |
| KuCoin | 0x45300136662dd4e58fc0df61e6290dffd992b785 (KuCoin 17 hot wallet) + 5 KuCoin deposit addresses (0xe0ed381a0c2a0f5e8dfeb6028d29f50e25a2d434, 0x45241643dd7b8b07367471ffb6c7d50a14a99512, 0x14df86adddea7a7f868e97ec24317a2ec00bf9c3, 0x5291b00aba74e1b600f864ad852bbf8911fb6e92, 0xc20bfc895075b0390209100e5f67a25fdd7d68da) |
≈1,029 | 12 |
| HitBTC | 0x80787af194c33b74a811f5e5c549316269d7ee1a (HitBTC: Hot Wallet 4) |
≈100 | 2 |
| Unattributed | 0xdf43559c86debbe1909067ef9e828035d2bd4bf2 (≈100 ETH; tagged “Funded By KuCoin 17”), 0x5045607605d931d4895d3bc8b88d8fe0851f8299 (≈70 ETH) |
≈170 | 3 |
The ChangeNOW wallet has >1.23 million outgoing transactions - characteristic high-volume exchange infrastructure. So the Ethereum proceeds were split almost evenly between ChangeNOW (non-KYC instant swap; funds typically converted to another asset/chain) and KuCoin (KYC exchange - records subpoena-able), with a smaller amount to HitBTC (KYC exchange) and ≈170 ETH not yet attributed to a labelled venue.
All 30 dispersal transactions (0x6c2eab82ba2897a6e99fb6af018020da15123976 > deposit address > exchange):
| # | Time (UTC) | ETH | Transaction hash | Deposit address | Forwards to |
|---|---|---|---|---|---|
| 1 | 06-10 20:51:35 | 50 | 0xa206fa2dbf7c84237afe86cbc75fdbd18482ff3eaf93a838b5a516dacb702183 |
0xf4f50ed681136969cfec8ae7dc95f7f82e1b5897 |
ChangeNOW |
| 2 | 06-10 20:53:59 | 50 | 0xf62812cc55a2485a0ab6612b46bb2d48840f13cb5a61e72bd283e4b5e618a4ec |
0xc466504f1b38faa12f96c462f6962513feaccfa5 |
HitBTC |
| 3 | 06-10 20:55:11 | 50 | 0x59e06f4259247423cd405b02afd36ba8709d17f1b3e0ef022af043a2e58900a5 |
0x8ec5569bf864dc3c2b1b950839231e4b1861f056 |
HitBTC |
| 4 | 06-10 20:56:23 | 50 | 0xc185c90b3d57606986f17f63fdb12be6dfa777a350f48d41000cc4e8c23b29e9 |
0x1eafd8c5def782a2b5d8b7756787ae0d533f19c8 |
KuCoin |
| 5 | 06-10 20:57:59 | 50 | 0xe3fc56ed4511414916f6e214c112a2f9c09fedf44d082a3fb24b04edbc5634ce |
0xf32a06aa3f26ae0f605ff1f03256211766f1b886 |
KuCoin |
| 6 | 06-10 21:01:59 | 100 | 0x88a8e4063aa20b94f1fd57b6a0ba5707fe130eb4d8a49e0175264768df791f93 |
0x67e25c71e03b7a251992ba60d31fd11e5be0b46c |
ChangeNOW |
| 7 | 06-10 21:15:11 | 80 | 0x374ceb56bbfed3a8611c2be069695e4ce88fba9d31ac63c747754ce38c8175f2 |
0xdacf61aa002722a697ff3a6562f32dfc3687d36c |
ChangeNOW |
| 8 | 06-10 21:15:47 | 70 | 0xda801555eb73f17733fe337b69a37761fa2fd4fe42eda20163dc6ef4ed6d93d8 |
0xc3e2f603bf25e8226e2370765b0b623647fa848b |
unattributed |
| 9 | 06-10 21:16:47 | 60 | 0x30d8a57d487844798bb3531bff55c11ddb131b700b268cad0d0ddf4709cbda37 |
0x517e0c3260227627dbd0115fe399f82a86804c28 |
KuCoin |
| 10 | 06-10 21:21:23 | 50 | 0x682d058fef74d12677cf6d70a9213eb28b3b3838d9b9028d86ada2ad227776eb |
0xd49b8443fee179ce913c54f8e5e362caedebad94 |
KuCoin |
| 11 | 06-10 21:40:47 | 80 | 0x7923522c7d06375ed7ab96931d9bd6dbe562634bc4563843a45c0d1d74e8fad0 |
0xe5db12009bf186ba3801bb5dcc2e158adfa3abdd |
KuCoin |
| 12 | 06-10 21:42:11 | 100 | 0xfc20603752515f108f404c33e00a69a8a3d4a968b7c1c1fead1976f84e93bc0f |
0xf7bbb4fb43e63cc8f182cb89217c45abd43bc3b9 |
KuCoin |
| 13 | 06-10 21:43:23 | 60 | 0xab58006bd46f77bac25d8d3af3d77806222fb08972c1e4b89f29382309305388 |
0xc12fd863a9875a2b8aa1cc7461b953267ddc5b0e |
ChangeNOW |
| 14 | 06-10 22:07:35 | 90 | 0x184b8b45e6a9290236ac772d7026681c749195a81a9cc759d5f6c33cc9e1f391 |
0xb6156c50b75b0525bc6468e4664f9ee48de95a70 |
KuCoin |
| 15 | 06-10 22:08:47 | 100 | 0xc866b256ce2a7ea45d41526a176ec7f36af4b449d873f54a7558b0306abf7a99 |
0x0187f9b44362ca561a34877ba0e9473ab060f725 |
KuCoin |
| 16 | 06-10 22:09:59 | 80 | 0xf220257edbe524738207e05f28fef9e58c7ae9d4c741c16974a84cce6b85e60c |
0x4de57c31b3279eef344568f51fa3e23ef80cb13b |
ChangeNOW |
| 17 | 06-10 22:31:23 | 90 | 0x480981f411e26d7f11e4d88db89b2aaf8a3826add4b0399e87b811cffdae33d8 |
0x40b42df7d07a4b834e29184b75bbe518b29b53cb |
ChangeNOW |
| 18 | 06-10 22:32:35 | 100 | 0x8803e97a359b217e2b539c6f88c2ca371c2b6e93ad6473d09d0655f617e217e4 |
0xd73a218297c160e021eb00e328a53e507d201290 |
KuCoin |
| 19 | 06-10 22:33:47 | 110 | 0x4cf74260f406801fd0859b772b9c2d0cc8ae67e6806f4dff17f0c94e72528a05 |
0xf039d57ed420e29e5a6e3161bed54ef1c0967882 |
KuCoin |
| 20 | 06-11 06:59:11 | 50 | 0xd82b75e66a716e198b83288e14f8a5dc47be09dca8c8e96a0189c73ab1d5dd10 |
0xe5130ade3f6d69cb296be538751629eea6d37b5e |
unattributed |
| 21 | 06-11 07:00:47 | 60 | 0x887160577084600eb531ae3bdf49e346b2b14f5c5ab3188d88c0b83ede0b64e4 |
0xd8df7fd53de21370a5dde58a17d35e1f5fc0bc52 |
ChangeNOW |
| 22 | 06-11 07:55:23 | 80 | 0x26749288ec7e55a85c5ea8371148bdf5690367fffcb0877f7cc055b2288372b4 |
0x2c08e99e3856a04cec1da812aacd680554a4c56c |
ChangeNOW |
| 23 | 06-11 08:03:35 | 90 | 0x6e8d226278902967c849b4f604262c68b2ee941f7289c0d2c3baf171bbf6daa5 |
0x67f0eb707404a3fbe47503cc4b44bf25b2889ce0 |
ChangeNOW |
| 24 | 06-11 08:12:11 | 90 | 0x8cbc6c5845b57627f3bdb63d85c51d4e9cf4b3b9871c06c2c42c1e77769a767f |
0x8364b1bf1d12aa32f323fd509881101e51825aa3 |
ChangeNOW |
| 25 | 06-11 08:25:35 | 90 | 0x90aafcd4e12a7053e5dbe8999da1a07fd9a97be9e1e937c0008a6e6046332841 |
0x5d88861ed04844e5ac51cc891cd73ae62a2f2c7a |
ChangeNOW |
| 26 | 06-11 08:54:35 | 50 | 0x354c3254f569708c12b6a5aadb280e8a7bb98128aace4d99ac0709e97354f221 |
0xb04331ae1164b8a4703810a53b0e4b53e4eb7c11 |
unattributed |
| 27 | 06-11 08:55:47 | 90 | 0x83d12ae5bd45a35a59604fc4c9d9eeafe11980db8096cb6a340b153d307216f0 |
0x74a4a5c0c6ae470ba1e2bf972a20c9feab4a4219 |
ChangeNOW |
| 28 | 06-11 09:01:23 | 90 | 0xda267b41077da173007b33b2c953126a179557d3f425291fcf259cef25095bd6 |
0x528beb3cc2d9ccdd357505c50cd1fa630c868a88 |
ChangeNOW |
| 29 | 06-11 09:10:47 | 100 | 0xcdb8c7f007f90bb079ee744e5d6188d1b0410e6fdd56f6ee57645c94724058ad |
0xd3ef2d457f5655ab61216324a242c63bb0f5d807 |
KuCoin |
| 30 | 06-11 09:19:47 | 139 | 0xc311d3f1099460069e88d66d5ad9e94046b560c0fa2facfd74232c10b685ec84 |
0x737cf06bef5dd1f2942293ac5e677086b364ebc8 |
KuCoin |
(All timestamps 2026; “Forwards to” is the exchange the deposit address relays to in its next hop. Totals: ChangeNOW 1,050 ETH / KuCoin 1,029 ETH / HitBTC 100 ETH / unattributed 170 ETH = 2,349 ETH.)
4.4 BSC leg (WBNB)
The two WBNB forwards (Section 3) were delivered on BSC to router 0x43d090025aAA6C8693B71952B910AC55CcB56bBb and forwarded (same tx 0xee0fc939a6ac7e9cc80bf298af25a691d25d2d54911e968035a79ea3a760a21d, 2026-06-10 19:51:43) to 0xe4cdbcb3887c74f75198e5d12d8668f57180da55. That address then moved the BNB to ChangeNOW (ChangeNOW hot wallet counterparty on BSC) - the same cash-out venue as the Ethereum side.
4.5 Obfuscation noted
On both chains the attacker scattered spoof tokens - ERC-20/BEP-20 tokens whose symbols imitate “ETH”/“BNB” using look-alike Unicode characters (e.g. E឵Τ឵H, ĖTḨ, ΒΝΒ) - to many vanity addresses. These carry no real value and appear designed to pollute the transaction graph and mislead automated tracing. The genuine value movements are the native ETH/BNB and the real-token (WETH/WBTC/USDT/USDC/DAI/wstETH) transfers documented above.
4.6 Endpoint summary
| Chain | Real value out | Final venue(s) |
|---|---|---|
| Ethereum | ≈2,349 ETH | ChangeNOW (~1,050 ETH) + KuCoin (~1,029 ETH) + HitBTC (~100 ETH) + ~170 ETH unattributed |
| BSC | ≈106 WBNB | via 0xe4cdbcb3887c74f75198e5d12d8668f57180da55 > ChangeNOW |
| Axelar (residual, not yet moved) | ≈239k USDC, 6.2 WBTC, 64 WBNB, 248 AXL | held at axelar1hzra9z4zn8q0w8f3dj2wnw0xgetu8dfdhl6ad8 |