MANTRA Chain has stopped short of committing to a fund recovery plan in the full incident post-mortem report it published on August 28. The publication instead presented a formal recap of the August 20-21 incident, in which an attacker drained roughly 720.9 million MANTRA, worth about $3.6 million, from the project.

The disclosure formally assigned a dollar value to the one-week-old attack, which the project insists was caused by a coding flaw not directly related to its own code. MANTRA confirmed that law enforcement is now involved and that updates are pending on fund recovery efforts. The project also said it will update its circulating supply figures once it has a clearer picture of the tokens stuck in hacker wallets and the potential for recovery.

What caused the MANTRA exploit?

According to the MANTRA Chain post-mortem, the exploit originated in the shared cosmos/evm module the chain uses to run Ethereum-style contracts on top of the Cosmos SDK.

The affected version did not verify that an account could cover a call before it approved subtractions from that account's balance. The subtractions continued to go through because the code used unsigned integers, which cannot drop below zero. Instead, the value wrapped around to an enormous number.

This failure mode, known as integer underflow or wraparound, is a long-recognized bug class in blockchain code. In the Ethereum ecosystem, a similar arithmetic overflow in the ERC-20 contract behind the Beauty Chain (BEC) token in 2018 let an attacker generate vast token balances, and such incidents were a key motivation for the checked arithmetic that Solidity 0.8+ enables by default. MANTRA's case shows the same class of flaw can surface in the bridge-like modules that Cosmos-SDK chains use to interoperate with Ethereum-style contracts.

MANTRA clarified that none of its validator keys, governance controls, or multisig signers were breached, and insisted that the flaw the attacker exploited did not come from its own end. MANTRA wrote that "The attacker required no privileged access," noting that a permissionlessly deployed contract and a self-funded wallet were enough to carry out the attack.

How much did MANTRA lose?

Per MANTRA, the attacker extracted about 600 million MANTRA from its burn address and another 120.9 million tokens from a dormant genesis-era multisig tied to an old incentive campaign.

MANTRA stressed the technicality of the attack's impact, insisting that no new tokens were minted. Instead, the exploit released roughly 720.9 million tokens that had been sitting outside the circulating supply and were considered economically inert back into circulation.

The report also noted the programmatic cadence of the token movements, as transactions appeared to execute at fixed sizes at short intervals rather than being processed manually.

MANTRA missed the transactions in real time

By its own admission, the MANTRA team did not catch any rogue transactions during the first four hours of the breach. The project attributed the lapse to a lack of round-the-clock monitoring of a burn address that was meant to hold immovable tokens. The gap is a familiar one in post-mortems across the industry, where burn addresses and treasury wallets are frequently treated as inert and monitored less closely than active hot wallets, even though they often hold some of a protocol's largest balances.

In the hours before the team spotted the red flags, the attacker ran two transactions and moved most of the haul off-chain before validators halted the network at 23:13 UTC, 14 minutes after the second drain. The attacker's wallet still contained 37.96 million tokens when the chain was halted.

The network remained offline for 30 hours and 13 minutes until 05:26 UTC on August 22, when validators coordinated a restart on the patched v8.4.0 release.

The episode caps a dramatic 18 months for a project still trying to rebuild trust. MANTRA's former OM token collapsed more than 90% in a single April 2025 session, erasing over $5 billion in value, as Cryptopolitan covered at the time. Even Inveniam Capital Partners, which put $20 million into MANTRA in 2025, acknowledged past issues when it agreed in June to acquire the project.

When the halt first hit, the token sank 18.5% to a record low near $0.004126 before recovering, according to CoinGecko data. With law enforcement now involved and recovery prospects unresolved, the outstanding questions for MANTRA watchers are the fate of the 37.96 million tokens still sitting in the attacker's wallet when the chain halted, whether Inveniam-backed management adjusts supply disclosures, and how quickly the project's next scheduled module updates ship.