MANTRA Pauses New Unstaking Requests for Seven Days Amid Web3Auth and Keplr Wallet Exploit
Key Takeaways
- •MANTRA has paused all new token unbonding transactions network-wide for seven days in response to a private-key exploit involving Web3Auth and Keplr wallets.
- •Attackers used stolen private keys to submit unauthorized unstaking requests for victims' staked OM after taking their liquid MANTRA holdings.
- •The suspension affects even holders untouched by the exploit, since no new unstaking requests can enter the network's waiting queue during the pause.
- •Several wallets associated with the attackers have been frozen through Governance Proposal 41, and MANTRA is working with Web3Auth and Keplr on recovery efforts.
- •MANTRA will reassess the pause after seven days and has reserved the right to impose additional suspensions if the situation warrants.
MANTRA has temporarily suspended new token unbonding transactions for seven days in response to an ongoing exploit involving Web3Auth and Keplr wallets that has allowed attackers to access users' private keys and unstake their MANTRA holdings.
The suspension covers new unstaking requests network-wide, meaning even holders unaffected by the exploit cannot begin withdrawing staked OM while it is in place. It also closes the same unbonding path the attackers were using to move staked balances obtained through stolen keys.
The project said on Friday, Nov. 13, that community members had reported attackers unbonding their staked tokens without consent after stealing their liquid MANTRA holdings.
According to the team, several wallets associated with the attackers have already been frozen through Governance Proposal 41, an on-chain governance measure, and MANTRA is working with Web3Auth and Keplr on recovery efforts.
Background
MANTRA is a layer-1 blockchain focused on the tokenization of real-world assets, and its native token is OM. The network is built with the Cosmos SDK, the development framework underpinning many proof-of-stake chains in the Cosmos ecosystem, where token holders can stake assets to help secure the network and later submit unbonding requests to withdraw their staked tokens.
In Cosmos SDK-based networks, unbonding is not instantaneous: unstaking requests enter a waiting period during which the tokens remain locked. Halting new requests keeps additional staked tokens out of that queue for the duration of the seven-day suspension.
Keplr is a widely used browser-extension wallet for Cosmos-ecosystem chains, while Web3Auth provides embedded wallet infrastructure that lets applications onboard users through simplified login flows and private-key management services. The incident demonstrates how a private-key compromise extends past liquid balances: control of a key also means control of its staked position, which is how the stolen keys produced unauthorized unbonding requests.
What Happens Next
MANTRA said it would reassess the temporary pause after seven days and reserved the right to impose additional suspensions depending on how the situation develops. Readers tracking the incident have three concrete markers to watch: the seven-day reassessment of the pause, the progress of recovery work with Web3Auth and Keplr, and whether the team imposes additional suspensions under the authority it has reserved.
Sources: Crypto Briefing · CryptoNews
