What MANTRA disclosed
MANTRA has published a post-mortem describing the unauthorized movement of 720,923,967.99 MANTRA from two unusual sources: a burn address and a dormant genesis-era multisig.
Immediately before the incident, MANTRA valued the affected tokens at approximately $3.6 million.
The project says the event did not involve compromise of validator, administrator, governance or multisig private keys.
That distinction matters. A key compromise would imply a very different security failure from a software defect allowing balances to be moved without valid authorization.
How the incident fits the Cosmos EVM vulnerability
The incident is being tracked alongside the broader Cosmos EVM underflow issue because the affected chain used the shared software environment implicated in the multi-chain exploit wave.
The critical question is how the vulnerable balance logic interacted with special accounts such as burn addresses or legacy allocations.
A burn address is generally expected to be economically inaccessible. If software permits value to be recreated or transferred from balances that are supposed to be unreachable, assumptions about token supply and accounting can fail even without an attacker stealing a privileged key.
What was not compromised
According to MANTRA’s post-mortem:
- validator keys were not compromised;
- administrator keys were not compromised;
- governance keys were not compromised;
- multisig signing keys were not compromised.
These assertions narrow the likely failure domain toward software and state-accounting behavior.
They do not eliminate all risk. The incident still demonstrates that assets could move in a way the network did not authorize.
Chain response
MANTRA resumed the network using patched software and did not roll back the chain.
Avoiding a rollback is significant because rollback decisions can create additional governance and settlement risk. Reversing finalized history may protect some users while undermining certainty for others.
MANTRA’s chosen response preserves the existing chain history while attempting to close the vulnerability through software changes.
Why the token amount looks much larger than the dollar value
The number of affected MANTRA tokens — more than 720 million — is large relative to the reported $3.6 million pre-incident valuation.
Readers should therefore distinguish:
- token quantity, which reflects the affected state balance;
- pre-incident market value, which reflects the token price at the relevant time;
- realized attacker proceeds, which depend on liquidity, execution and recovery.
Moving hundreds of millions of tokens does not mean an attacker successfully realized hundreds of millions of dollars.
What remains unresolved
The post-mortem improves clarity, but several risk questions remain:
- How much value was ultimately monetized?
- How much was frozen or recoverable?
- Which centralized exchanges received related funds?
- Did the event create permanent token-supply distortions?
- Are all downstream deployments now patched?
- Will MANTRA change monitoring around dormant or special-purpose accounts?
Risk assessment
Critical.
The event involved unauthorized movement of a very large token balance and required an emergency software response.
The fact that MANTRA reports no validator or administrator key compromise reduces one category of systemic risk, but it does not reduce the severity of the underlying accounting vulnerability.
What to watch next
CEXVia is monitoring exchange tracing, attacker balances, recovery, final economic loss and any token-supply remediation.
The most important longer-term question is whether the incident leads Cosmos EVM chains to monitor state invariants around burn, module and dormant accounts more aggressively.
FAQ
How many MANTRA tokens were affected?
MANTRA reported unauthorized movement of 720,923,967.99 MANTRA.
What were the tokens worth?
The project estimated their value at approximately $3.6 million immediately before the incident.
Were MANTRA validator keys hacked?
MANTRA says validator, administrator, governance and multisig keys were not compromised.
Did MANTRA roll back the blockchain?
No. The chain resumed using patched software without a rollback.
Is the incident closed?
The immediate chain response is complete, but recovery, tracing and final-loss questions remain open.