Incident of , source MANTRA post-mortem with figures as of
MANTRA Chain security: the 20 August 2026 incident, the fix and what changed
On 20 August 2026 an attacker exploited an unsigned-integer underflow in an upstream EVM module and moved 720.9 million MANTRA, about US$3.6 million at the time, from the burn address and a legacy multisig. No validator, administrator or governance keys were compromised and no customer account was debited. The chain halted for 30 hours 13 minutes and resumed on patched release v8.4.0.
Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.
The incident in figures
- Moved
- 720,923,967.99 MANTRA, approximately US$3.6 million at $0.005 per MANTRA
- From the burn address
- 600,000,035.56 MANTRA
- From a legacy multisig
- 120,923,932.44 MANTRA
- Downtime
- 30 hours 13 minutes
- Recovered
- None as of
Source: MANTRA post-mortem, mantrachain.io/resources/announcements/20th-august-2026-full-incident-post-mortem, read 6 October 2026.
Figures as of , source MANTRA post-mortem
Incident summary
What happened
An attacker used an unsigned-integer underflow in the balance-accounting layer of cosmos/evm, an upstream dependency of the chain, to move 720,923,967.99 MANTRA. Of that, 600,000,035.56 MANTRA came out of the burn address and 120,923,932.44 MANTRA out of a legacy multisig from the chain's genesis era. The post-mortem values the total at approximately US$3.6 million, at $0.005 per MANTRA.
What was not affected
The post-mortem makes three statements, quoted here as published:
- "No validator keys, administrator keys, governance controls or multisig signers were compromised."
- "No customer account, exchange-held customer balance, deposit address or application contract was debited."
- "No new MANTRA was created or minted."
These are MANTRA's own statements. This page repeats them with their source and adds no independent confirmation.
Status of the funds
As of 28 August 2026 no tokens had been recovered. About 37.96 million MANTRA, 5.27% of the amount moved, was still in the attacker's account and had been immobilised. The post-mortem calls recovery "a law-enforcement matter".
Status on : Not published
All times UTC, source MANTRA post-mortem and weekly transparency reports 15 and 21
Timeline in UTC
- EVM compatibility goes live with release v5.0.0, which brings the cosmos/evm module into the chain.
- The attacker moves 720,923,967.99 MANTRA out of the burn address and a legacy multisig.
- The chain halts.
- No blocks are produced.
- Blocks resume on patched release v8.4.0. The upgrade is coordinated "across 38 independent validators".
- Date of the post-mortem's figures: no tokens recovered, about 37.96 million MANTRA immobilised.
- Proposal 38, a mainnet upgrade to v8.7.0, passes with 43.70% turnout against a 33.40% quorum.
Cause as stated by MANTRA, source post-mortem of the incident
Root cause
The flaw was an unsigned-integer underflow. An unsigned integer is a number that cannot go below zero. If code subtracts more than the stored amount without checking first, the value does not fail. It wraps around to a very large number, and every later calculation that trusts it is wrong.
Here the error sat in the balance-accounting layer of cosmos/evm, the module that connects Ethereum-style contracts to the chain's native ledger. MANTRA did not write that module. It is an upstream dependency that the chain adopted with the EVM upgrade of 17 September 2025. The result was a debit from two addresses that nobody had authorised, without any key being compromised.
As described in the post-mortem, flaw exploited
This page gives no exploit detail beyond what MANTRA has published.
Changes as stated in the post-mortem, status checked
What changed after the incident
Patched releases
The chain restarted at 05:26 UTC on 22 August 2026 on release v8.4.0, which the post-mortem calls the patched release. A later mainnet upgrade, v8.7.0, passed an on-chain vote as Proposal 38 on 25 September 2026. The sources read for this page do not say whether it contains further fixes linked to the incident.
Monitoring changes
The post-mortem lists four changes. Three concern MANTRA's own monitoring and the fourth concerns the upstream code. Each is a stated commitment. None is shown here as done until there is evidence.
Status on , source MANTRA post-mortem
| Change | Status | Evidence of completion |
|---|---|---|
| Detect debits that cannot have been authorised | Stated | Not published |
| Additional monitoring from raw events | Stated | Not published |
| Monitor addresses assumed inert | Stated | Not published |
| Push for better upstream disclosure | Stated | Not published |
| Last reviewed . Source: MANTRA post-mortem of the 20 August 2026 incident. | ||
Upstream disclosure
The fourth change reaches beyond MANTRA. The flaw sat in code that MANTRA uses but does not maintain, so it depends on the maintainers to hear about weaknesses early. MANTRA says it will push for better disclosure from upstream. Permissioned token standards such as ERC-3643 run on the same EVM layer, and the platform page explains how the platform enforces compliance.
Checked , issuer and date named in each block
Audits and assessments
Each block names who issued the evidence and when. Where there is no issuer or no date, the block says so.
- Protocol assessment
- MANTRA's 2024 review lists, under November 2024, that Hacken completed a blockchain protocol security assessment. Hacken's own page lists one audit of MANTRA Chain, labelled "Blockchain Audit / Jun2024", for a Layer 1 on Cosmos written in Golang. It shows 16 findings: 1 critical and 1 high with the status "fixed", and 1 medium, 5 low and 8 observations with the status "accepted". The date on the report and the code it covered are not confirmed. The assessment predates the cosmos/evm module adopted on 17 September 2025, where the August 2026 flaw sat.
- Issuer: Hacken. Hacken audit page for MANTRA Chain, Internet Archive copy of 15 June 2026
- Partner tags
- The partners page tags Hacken and code4rena as "Security". A tag is not an audit. No scope or date is given for either.
- Issuer: MANTRA. mantrachain.io/partners, read 11 October 2026
- Post-incident audit
- No independent audit of the patched EVM module has been published.
- Issuer: none. Date: none
- Bug bounty
- No bug bounty programme was found on mantrachain.io.
- Issuer: none. Site read 6 October 2026
- Certificates and insurance
- No SOC 2 report, ISO 27001 certificate or insurance cover is evidenced in the sources read for this site. Holdings do not benefit from any form of financial protection.
- Issuer: none. Site read 6 October 2026
- Incident history
- Two events are on MANTRA's own record: the protocol exploit of 20 August 2026 and the OM price collapse of 13 April 2025, which was a market event.
- Issuer: MANTRA. Post-mortem with figures as of 28 August 2026; statement of 16 April 2025
As of , source Weekly Transparency Report 21 and the post-mortem
How the network is secured
Validators and staking
MANTRA Chain is a proof-of-stake network. Validators produce blocks, and holders stake MANTRA with them. On 4 October 2026 the bonded ratio was 28.77%, about 2.37 billion of 8.22 billion MANTRA, and staked coins took 8 days to unbond. The post-mortem refers to 38 independent validators, and Securitize joined the set, as announced on 22 May 2026. Staking carries its own risks, set out under MANTRA token supply and staking risks. Two of the terms are defined in the glossary: validator and multisig.
Governance and upgrades
Upgrades pass on-chain votes. Report 21 counts 39 proposals to date, and Proposal 38 passed on 25 September 2026. The patched release of August 2026 was coordinated across 38 independent validators while the chain was halted, according to the post-mortem. Weekly figures are on the page with network activity and fee data.
Custody and key management
- Custody model
- On a public chain, coins sit at addresses, and whoever holds an address's private key controls them. The Association's Terms say it offers no products or services of its own. The site also says institutions can use custodial integrations "with fully regulated digital asset custodians across multiple regions". Which custodians, and on what terms, is not set out in the sources read for this page.
- Issuer: MANTRA. Terms of 14 November 2024; mantrachain.io/for-institutions, read 6 October 2026
- Key management
- The post-mortem states that no validator keys, administrator keys, governance controls or multisig signers were compromised. Coins still left a legacy multisig, and one change the post-mortem lists is to detect debits that cannot have been authorised. Who holds the administrator and multisig keys, and under what thresholds, is not published.
- Issuer: MANTRA. Post-mortem with figures as of 28 August 2026
Website and transport security
On 6 October 2026 the home page of mantrachain.io sent these response headers: Strict-Transport-Security with a max-age of 31536000 and includeSubDomains, X-Content-Type-Options nosniff, a Content-Security-Policy, Referrer-Policy strict-origin-when-cross-origin and X-Frame-Options SAMEORIGIN. They limit some browser-side attacks on the website. They say nothing about the chain's code.
Checked , source named in each row
Is MANTRA Chain legit? What you can verify
This page gives no verdict. It lists facts that anyone can check at the source, then says what is still open. The licence detail is under regulatory status, and the companies and people are under entities and leadership.
As of , six facts and where to check each
| Fact | What the source shows | Where to check |
|---|---|---|
| Operator | The site Terms name MANTRA Chain Association as operator. | mantrachain.io/terms |
| Licensed company | Mantra Finance FZE is licensed by VARA under VASP Licence VL/25/02/001, status Active. | Public register entry for Mantra Finance FZE |
| Weekly reporting | 21 weekly transparency reports, the newest published on 7 October 2026. | mantrachain.io/transparency/ |
| Incident disclosure | A public post-mortem of the 20 August 2026 exploit, with amounts and times. | mantrachain.io/resources/announcements/ |
| EU white paper | A crypto-asset white paper under MiCA Article 6. It is a disclosure document, not an approval. | mantrachain.io/whitepaper/ |
| Protocol assessment | One Hacken audit of MANTRA Chain, labelled June 2024, with 16 findings. | Hacken audit page |
| Last reviewed | ||
Still open: the company numbers, the group chart, the date and scope of the Hacken report, and what has happened to the funds since 28 August 2026.
Event of , source MANTRA statement of
The April 2025 OM price collapse
MANTRA states that on 13 April 2025, at about 18:28 UTC, the OM token fell 92% in roughly one hour. Its statement of 16 April 2025 says "there were no sales by the MANTRA team during this period" and attributes the fall to forced liquidations on centralised exchanges. On 21 April 2025 the CEO committed to burn his 150 million OM team allocation, and MANTRA said it was in talks about burning a further 150 million OM.
This is the company's own account, and it has not been tested here against exchange data. It describes a market event, a fall in price on exchanges, and not a breach of the protocol. OM became MANTRA on 2 March 2026, with a 1:4 redenomination.
Domains and handles read , source mantrachain.io/llms.txt
Staying safe as a user
Phishing sites and fake support messages are a standing risk for any crypto user. Check the address bar against the list of official domains before you connect a wallet, and reach social channels only through the handles listed here.
Seed phrases
MANTRA never asks for a seed phrase or a private key. Treat any request for one as an attack.
To report a phishing site or a suspected vulnerability, write to [email protected]. A dedicated security address has not been published. The contact page explains how to report a security issue.
Official domains
- mantrachain.io
- docs.mantrachain.io
- archives.mantrachain.io
- mantra.zone
- mantra.finance
- app.mantra.finance
- mantrausd.com
- docs.mantrausd.com
- mantrascan.io
- blockscout.mantrascan.io
- fluxtra.xyz
Official handles
- X: @MANTRA_Chain
- Telegram: MANTRA_Chain
- Discord: mantrachain
- LinkedIn: mantrachain
- YouTube: @MANTRAChain
- Instagram: mantra_chain
Answers checked , source MANTRA post-mortem and statements
Security FAQ
Was MANTRA Chain hacked?
Yes. On 20 August 2026 an attacker exploited an unsigned-integer underflow in cosmos/evm, an upstream module, and moved 720,923,967.99 MANTRA out of the burn address and a legacy multisig. The post-mortem says no validator, administrator or governance keys were compromised. The chain halted at 23:13 UTC and resumed on 22 August on patched release v8.4.0.
Were user funds lost in the August 2026 exploit?
No, according to MANTRA's post-mortem. It states that no customer account, exchange-held customer balance, deposit address or application contract was debited, and that no new MANTRA was minted. The coins came from the burn address and a legacy multisig. Holders were still affected in one way: the chain was down for 30 hours 13 minutes.
Has the vulnerability been fixed?
Yes, according to MANTRA. The chain resumed at 05:26 UTC on 22 August 2026 on release v8.4.0, which the post-mortem calls the patched release. MANTRA also listed three monitoring changes and a push for better upstream disclosure. Evidence that each of the four is complete is tracked in the table above.
Were the stolen tokens recovered?
No, not as of 28 August 2026, the date of the post-mortem's figures. About 37.96 million MANTRA, 5.27% of the amount moved, remained in the attacker's account and was immobilised. MANTRA describes recovery as a law-enforcement matter. The status on 11 October 2026 is not confirmed and is flagged in the incident summary.
Is MANTRA Chain audited?
Partly. Hacken completed a blockchain protocol security assessment that MANTRA listed in its 2024 review, with a link to Hacken's audit page. That page shows one audit, labelled June 2024, with 16 findings; the report date and scope are not confirmed. The assessment predates the EVM module where the August 2026 flaw sat, and no post-incident audit of that module has been published.
Is MANTRA Chain safe?
No network can promise that. The record is this: in August 2026 a flaw in an upstream module let an attacker move 720.9 million MANTRA, after which the chain was patched and MANTRA committed to new monitoring. According to the post-mortem, no keys were compromised and no customer account was debited. Crypto stays high risk, as the risk disclosure explains.
Why did OM fall in April 2025?
Forced liquidations on centralised exchanges, according to MANTRA. Its statement of 16 April 2025 says OM fell 92% in about one hour from about 18:28 UTC on 13 April 2025, and that the team made no sales in that period. That is the company's account of a market event. It was not a breach of the chain.
Other questions are answered in the FAQ on MANTRA Chain, longer guides are in the learn hub, and the wider picture is in the MANTRA Chain network overview.
Read the full post-mortem
MANTRA's own account of 20 August 2026 is published at mantrachain.io/resources/announcements/20th-august-2026-full-incident-post-mortem. The risks of holding and staking the coin are set out in the risk disclosure.