MANTRA has switched off unstaking across its network after attackers holding keys stolen in the Web3Auth and Keplr exploit began unbonding victims’ staked tokens. The project said on Friday it was putting through “an emergency pause on all unbonding transactions for 7 days,” and the chain’s own records show how it was done: a single circuit-breaker transaction that disables the staking module’s undelegate message for every account on the network until someone turns it back on.
What MANTRA said
According to MANTRA, users had complained that hackers were “unbonding their staked MANTRA tokens without their consent.” That came after “any liquid MANTRA tokens have already been stolen,” the team said, meaning attackers who had already emptied spendable balances were now going after tokens locked in staking.
MANTRA said it would review the pause in seven days and reserved “the right to make further pauses.” It also stressed that the measure “does NOT freeze unbondings which are already in progress.” Unbonding on MANTRA takes eight days, and once that period ends the tokens become spendable by whoever controls the account. The team told affected users they “will need to redelegate before the 8-day unbonding process completes” so the attackers cannot claim the tokens.
How the pause works on-chain
The transaction MANTRA cited, 8CE659…C139E8, was included in block 19,633,728 on Friday, about 13 minutes before the announcement. It contains one instruction from the Cosmos SDK circuit module, MsgTripCircuitBreaker, which adds the staking module’s MsgUndelegate message to the chain’s list of disabled message types. Any new attempt to start unbonding is rejected while it stays on that list.
The breaker was tripped by the address mantra1s53ugc5xnsj5yjnz2qqrrlrekgtrxg8unke9ff. The chain’s circuit module lists five addresses, including that one, with permission to disable any message type. That is a faster route than governance, which MANTRA used earlier in the week, and it means the chain can halt a core staking function within a single block.
The “7 days” is a policy commitment, not a timer. The circuit module has no expiry setting. A disabled message stays disabled until an authorized account sends a reset transaction, and as of Saturday MsgUndelegate was still on the disabled list, alongside eight other message types.
The pause is narrower than it may sound. Redelegating from one validator to another is not disabled, and neither is the SDK’s cancel-unbonding message, which moves tokens out of the unbonding queue and back into a delegation. The chain runs Cosmos SDK v0.53, where that cancel option is built in. Claiming staking rewards is also still open, so rewards that build up on a compromised account can still be withdrawn by anyone holding its key.
Governance froze three wallets first
The “Gov Prop 41” that MANTRA referred to was an expedited upgrade proposal submitted on Nov. 9 and passed when voting closed on Nov. 10. Alongside a mandatory security release, v8.8.0, it carried a sanction-module instruction that blacklists three addresses. The proposal summary said: “Some additional restrictions are also added due to Keplr Wallet exploit due to flaw in Web3Auth.”
Those three addresses held about 7.46 million MANTRA between them on Saturday, according to the chain’s bank module. At CoinGecko’s price of roughly $0.0026, that is under $20,000. Neither the proposal nor MANTRA’s post said how much the attackers have taken from MANTRA stakers in total.
Where the Web3Auth incident stands
The exploit traces back to Web3Auth, the provider behind Keplr’s Google and Apple sign-in, which Keplr paused on Nov. 7. Web3Auth later named recovery wallets it used to sweep exposed accounts before the attacker could reach them.
In a consolidated update dated Nov. 13, Web3Auth said logins and wallet access had resumed for existing users, that SDK versions 9 and older are deprecated, and that new sign-ups on its legacy networks will be enabled by Nov. 23 for developers who migrate. Recovered funds are being held while it works with Keplr on returning them, and it expects to share details of that process “in the coming days.”
The best public tally so far comes from blockchain data firm Bitquery. Its updated investigation, covering Nov. 1 to 12, puts the attacker’s take at no less than $1.82 million from 7,842 Cosmos wallets, 52 Ethereum wallets and 13 Hyperliquid accounts, with $1.01 million gone before Web3Auth’s first rescue sweep. Bitquery separately counted $6.0 million moved into Web3Auth’s recovery addresses.
What to watch
The next marker is a MsgResetCircuitBreaker transaction, or a statement that the pause is being extended, around Nov. 20. Stakers with unbonding already under way are on a hard eight-day clock and should act through official MANTRA and Keplr channels only, since fake “recovery” links tend to follow incidents like this one.
FAQ
Can I unstake MANTRA right now?
No. New unbonding requests are disabled network-wide by a circuit breaker tripped on Nov. 13. MANTRA said it will review the pause after seven days.
What happens to unbondings that started before the pause?
They continue and complete after the normal eight days. MANTRA told affected users to move those tokens back into a delegation before the period ends so attackers cannot claim them.
Were MANTRA’s own systems hacked?
MANTRA described the problem as an “upstream exploit.” The keys were exposed through Web3Auth’s embedded wallet service used by Keplr’s social login, not through a flaw reported in MANTRA Chain itself.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
