Axelar Network responds to security incident, vulnerability originated from third-party token contract

Axelar Network stated in its announcement that neither Axelar Network nor the IBC protocol was attacked, and the affected token smart contract was not developed, deployed, or maintained by Axelar Network. The exploited contract was a forked version of CW20-ICS20, where the developers removed two core security checks, resulting in an "infinite minting" vulnerability. This fork altered the original contract's trust model and had not undergone a security audit. Axelar Network emphasized that this incident was not due to any inherent logic flaws or problems with the IBC protocol, but instead stemmed from security risks introduced by third-party contract modifications.