- MANTRA stopped producing blocks late on 20 August and said the following morning that it had found the root cause and contained the threat. The chain has since restarted.
- Cosmos Labs confirmed on 28 August that an accounting flaw in the shared Cosmos EVM module was exploited on six networks, MANTRA among them, and now says it wrongly cleared the bug when it was first reported. It puts the total taken at $5.7m.
- MANTRA accounts for $3.6m of that, the largest single loss: about 720.9 million moved out of two addresses by an unprivileged wallet, with no , administrator, governance or multisig keys compromised. MANTRA says the patch reached chains only 20 hours before the attack began and did not say what it fixed.
A going down isn’t like a website going down. When MANTRA‘s Layer 1 stopped producing blocks late on Thursday, every transfer, every staking action and every exchange deposit that routed through it stopped at the same moment, and stayed stopped.
While a chain is halted there is nothing a holder can do at their end. You can’t move the token to an exchange, unstake it, or send it to another wallet, because there’s no network available to record the transaction. How long that lasts is decided entirely by the people running the chain.
The wider point is where the fault sits. MANTRA pointed at code it shares with other blockchains, and Cosmos Labs has since confirmed that the same flaw was used against six chains and that it contacted around 40 networks running the software. A bug in a shared component is not one project’s problem, and holders of tokens on any of those chains inherited it without ever choosing to.
What is confirmed, and what is MANTRA’s own account
MANTRA disclosed the halt at 8:10 p.m. ET on 20 August, according to The Defiant, and said on Friday morning that the root cause had been identified and the threat contained. CryptoSlate reported the network still down on 21 August, with transactions, transfers and staking unavailable and a restart depending on a patch being tested. CoinDesk reported the token’s fall to a record low in the minutes before block production stopped.
On 28 August, Cosmos Labs published a postmortem that settles what the software was. It says an accounting flaw in Cosmos EVM was exploited on six networks, MANTRA, TAC and KiiChain among them, and puts the total taken at $5.7m: roughly $2.87m converted through decentralised exchanges and an estimated $2.85m through centralised venues, with accounts connected to the centralised activity since frozen. MANTRA accounts for $3.6m of that, the largest single loss, and on MANTRA an unprivileged wallet moved about 720.9 million tokens out of two addresses that had not authorised the 20 August transactions. Cosmos Labs says no validator, administrator, governance or multisig keys were compromised, which is a meaningful detail: the attacker didn’t need to take over the chain to take the tokens.
MANTRA isn’t accepting that account as it stands. The Block reported on 29 August that Cosmos Labs now says it wrongly cleared the bug when it was first reported to it, and that MANTRA has said the patch reached chains only 20 hours before the attack began and did not identify the flaw it fixed. A fix nobody had been told was urgent, arriving less than a day ahead of the attacker, is not a window in which 40 teams could realistically act.
We worked from those accounts rather than from MANTRA’s own incident page, which we weren’t able to read directly. That mattered for one detail. The Defiant’s headline named the Cosmos EVM module while CryptoSlate reported MANTRA identifying the vulnerable software only as an upstream dependency, and we stayed with the narrower version. The postmortem has since named the module, so the more specific reading was the right one.
What “upstream dependency” actually means
Almost no Layer 1 blockchain is written from scratch. A large number of them, including MANTRA’s, are assembled using the Cosmos SDK, a toolkit that provides ready-made components called modules: one handles staking, one handles governance, and an EVM module lets a Cosmos-based chain run Ethereum-style . A team picks the modules it needs and builds its own logic on top.
“Upstream” describes code maintained by somebody else that your software imports and relies on. You inherit the improvements other people make, and you inherit their bugs too. That’s the trade every chain of this type has made, and it usually looks like pure efficiency until a night like Thursday.
A vulnerability in a widely used module is potentially a vulnerability in every chain that imports it, and whether a given chain is actually exposed depends on which version it runs and how it’s configured. Cosmos Labs says it contacted around 40 networks once the attacks began, and that 13 other potentially exposed chains have patched. That is the mapping nobody had published a week ago.
The gaps
Three things were missing when the chain went dark: a release note or version number for the patch, an accounting of what had been taken, and a statement on whether other chains running the same module were affected. The postmortem covers the second and third. MANTRA still hasn’t published version details of its own fix, and CryptoSlate has since reported the chain back online with developers raising questions about code changes made without public notes.
The postmortem also opens a gap of its own. Cosmos Labs says the bug was wrongly cleared when it was first reported, around four months before it was exploited, so the flaw sat in the shared layer, logged and treated as harmless, while chains kept building on top of it. Whoever maintains a component that 40 networks import is doing the disclosure job for all 40. MANTRA’s version of the timeline, a patch 20 hours out with no description of what it addressed, describes a job that wasn’t done, and neither side’s sequence has been established by anyone outside the two of them.
Compare that with a separate incident the same week. The Block reported that BounceBit will sunset its own blockchain and migrate to BNB Chain after a roughly $3 million exploit, with an attacker moving about 286.5 million BB tokens out of nine wallets before block production was halted. Different chain, different team, no connection to MANTRA. Its numbers arrived with the announcement; the equivalent figures for MANTRA took eight days and came from the maintainers of the module rather than from MANTRA.
Restarting before the full explanation exists is normal, not sinister. Solana has halted and come back more than once with the detailed technical write-up arriving days later. MANTRA’s “contained” now has a second account behind it, which is more than it had at the time, though Cosmos Labs maintains the software at issue and its postmortem isn’t an independent audit.
If you hold OM from the UK
Tokens sitting in a wallet or staked on the chain are governed by the chain: they aren’t lost, they simply can’t be moved while no blocks are being produced. Tokens on an exchange are governed by that exchange’s own suspension policy, and platforms routinely pause deposits and withdrawals for a token whose network has stopped, because they can’t settle the transfer either.
With the network reported back up, that second category is where the live question now sits. A suspension that lasted as long as the outage was a technical consequence. A platform still holding OM deposits or withdrawals closed is doing so on its own policy, and screenshots and timestamps of any failed request are what a complaint later rests on. Our guide to delayed and frozen withdrawals covers how that process works with a UK-facing platform.
What to watch
MANTRA’s own release notes. The postmortem explains the module; it doesn’t tell you which version MANTRA is running now, or what else changed on the way back up, and that’s already the question its developers are asking.
Then the frozen accounts. Around half the stolen value moved through centralised exchanges and the accounts linked to it have been frozen, which is the point at which recovery either happens or quietly doesn’t. And the rest of the 40 networks Cosmos Labs contacted: six exploited and 13 patched leaves a long list unaccounted for, and one chain still running the old code is all it takes for this to get another chapter.
The patch timeline is the other open question, and the more consequential one. MANTRA says the fix landed 20 hours before the attack with no description of the flaw; Cosmos Labs has conceded it cleared the bug in error. The five other exploited chains, and the 13 that patched in time, are in a position to say which version of that they recognise. How a maintainer handles the next disclosure is what every Cosmos-based chain, and by extension everyone holding a token on one, is relying on.