MANTRA Chain Loses $3.6M In Cosmos-EVM Exploit, No Keys Compromised

MANTRA Chain is an EVM-compatible layer 1 built for real-world-asset tokenization. On August 28, it disclosed on X that an attacker had exploited a vulnerability in cosmos/evm. That is an upstream dependency the chain runs but did not write.

The attacker moved 720,923,967.99 MANTRA out of two addresses that never signed or authorized the transactions. No validator key, admin key, or multisig signer was touched. That is the core, unusual detail here. This was not a stolen-key hack. It was a defect in shared code that let an attacker debit accounts with no permission at all.

What Actually Happened

MANTRA_Chain's own full incident post-mortem lays out the mechanism. The affected version of cosmos/evm performed an unsigned balance subtraction. It never checked whether the amount exceeded what an account actually held.

Unsigned integers cannot go negative, so the subtraction wrapped into an enormous number instead of failing. The attacker combined that flaw with a specially built account and a call through a staking precompile. Together, those let the attacker debit balances that had never authorized any transaction.

The attacker pulled 600,000,035.56 MANTRA from the chain's own burn address. A second transfer took another 120,923,932.44 MANTRA from a dormant genesis-era multisig tied to an old incentive campaign. Combined, that is roughly $3.6 million at the token's pre-incident spot price. No customer account at any exchange was debited. Total token supply barely moved, changing by less than a trillionth of one MANTRA.

The Timeline, In MANTRA's Own Words

The first unauthorized transfer hit at 19:06 UTC on August 20. The chain's monitoring did not flag it, since the burn address was treated as permanently inert and outside normal alerting. A second transfer followed just under four hours later, at 22:59 UTC. MANTRA halted its own network 14 minutes after that, at 23:13 UTC.

In a follow-up post, MANTRA_Chain noted the underlying fix had actually been merged upstream on May 15. It did not reach a public cosmos/evm release until 20 hours before the attack, though, in release notes that never named a vulnerability. Blocks resumed at 05:26 UTC on August 22, after a coordinated restart across 38 independent validators on a patched release. The network was down for 30 hours and 13 minutes total.

MANTRA_Chain says it has since built new alerts for any debit from an account with no public key. That is the exact pattern the attacker used against the burn address. It is also pushing the cosmos/evm maintainers for clearer disclosure practices going forward. The original fix sat unflagged in release notes for months before the version reaching production carried real-world exposure.

Where Things Stand Now

As of August 28, MANTRA_Chain says no stolen funds have been recovered. About 37.96 million MANTRA, roughly 5 percent of the total taken, remains frozen in the attacker's wallet under the patch's new restrictions. The rest moved through an exchange deposit address in fifteen separate transfers, and MANTRA says law enforcement is now involved in tracing it.

CoinGecko's MANTRA price page shows the token near $0.0044, up on the day. That follows a 30-day decline of roughly 17 percent that predates this specific incident.

The token's price move since disclosure has actually been positive, not negative. That likely reflects relief that no keys were compromised, and that the network's response was fast once the issue was found. Price reactions like this are not a reliable signal and can reverse quickly.

This piece is a factual account of a disclosed security incident, not a signal to buy or sell. Anyone considering a position in MANTRA or similar tokens should treat it that way. Do independent research before acting on anything written here.