Imagine locking your crypto to protect it, only to discover that hackers may be able to unlock it before you do. That's the security nightmare facing some MANTRA holders.
On November 13, MANTRA temporarily suspended all new unstaking transactions for 7 days following a security incident involving Keplr wallets and Web3Auth.
But how did this happen?
🔍 What Actually Went Wrong?
The incident started with a vulnerability in Web3Auth, a service used by Keplr to support Google and Apple wallet logins.
Here's what happened:
🔹 Some Keplr accounts created through Google or Apple login had their private keys exposed.
🔹 Attackers gained unauthorized access to affected wallets.
🔹 After draining liquid assets, attackers reportedly began unstaking victims' locked $MANTRA tokens.
🔹 MANTRA responded by freezing several suspicious wallets through Governance Proposal #41.
🔹 The network then suspended new unstaking requests for seven days to limit further damage.
⚠️ The Biggest Problem: The 8-Day Waiting Period
MANTRA normally requires users to wait eight days when unstaking their tokens.
However, the emergency suspension does not automatically protect withdrawals that were already in progress.
MANTRA warned affected users to redelegate their tokens before the existing unstaking period expires. Otherwise, attackers controlling compromised wallets could claim those funds.
💰 How Much Was Lost?
The numbers are still developing.
Blockchain investigations have identified millions of dollars moving through affected wallets and recovery addresses. However, not all transferred funds represent stolen assets.
A more recent Bitquery analysis reported at least approximately $1.82 million in attacker-related losses, while millions more were moved into recovery wallets by Web3Auth to protect exposed funds.
Web3Auth says recovered assets are being held securely while arrangements are made with Keplr to return them to their rightful owners.
🛡️ Who Is Actually at Risk?
According to Keplr's security guidance:
✅ Seed phrase wallets were not affected by this particular incident.
✅ Hardware wallet accounts were not affected.
⚠️ Google and Apple social-login wallets may be affected.
If you use an affected social-login wallet, avoid depositing more funds and follow verified instructions from Keplr and Web3Auth. Never share your private keys or seed phrase with anyone.
📅 What's Next for $MANTRA?
MANTRA's seven-day emergency pause is a major development for its staking ecosystem.
The next important milestone is around November 20, when the project is expected to reassess the restriction.
Will unstaking resume, will the suspension be extended, and how will affected users recover their assets?
One thing is clear: Staking security is only as strong as the keys controlling your wallet.
💬 Your turn: How did you create your crypto wallet?
1️⃣ Seed phrase
2️⃣ Hardware wallet
3️⃣ Google or Apple login
Share your thoughts below. Have you ever considered the security risks of social-login wallets?
Not financial advice. DYOR.
#MANTRAPausesUnstakingFor7DaysAfterKeplrSecurityIncident #MANTRA #CryptoSecurity #Keplr #Web3Auth #CryptoNews #Blockchain #DeFi #CryptoWallet
