Locked doesn't mean safe: hackers are unstaking victims' MANTRA coins!
On Nov 13, MANTRA paused new unstaking for 7 days. The waiting delay that protects stakers only works if the person pressing unstake is you.
Staking means locking your coins to help run a blockchain. To get them out, you "unstake" and wait (8 days on MANTRA).
How it got here?
> Keplr, a popular wallet for Cosmos-based coins, lets you open an account with a seed phrase, a hardware device, or a Google or Apple login.
> With the Google or Apple login, a third-party service called Web3Auth generates your private key (the master password to your coins), not a phrase you wrote down.
> On Nov 6 a flaw at Web3Auth exposed some of those keys. Keplr's co-founder says it was not a hack of Keplr's code and estimates about 20% of Google and Apple login accounts were affected.
> Per MANTRA, thieves took the loose coins first, then started unstaking the staked ones. MANTRA froze their wallets by governance vote and paused new unstaking. It will reassess after 7 days.
Unstaking already underway is not paused. Per MANTRA, anyone with an unstake running must restake (redelegate) before the 8 days end, or the thief can claim it.
How big is it? Not settled. Bitquery traced about $6M moving out of 44,000+ wallets, but part was Web3Auth rescuing coins ahead of the thieves. GoPlus counts at least about $1M stolen. No final total or refund plan yet.
Quick check, per Keplr's advice:
- Seed phrase and hardware wallet accounts were not affected. Google or Apple login accounts were.
- If yours is a social login: stop depositing and move loose coins to a seed phrase or hardware account.
- Ignore DMs and links offering "recovery help". Trust only official Keplr and Web3Auth posts.
What to watch? MANTRA's review, about Nov 20 UTC. Lifted, extended, or explained?
Whoever holds the key controls the lock.
How was your wallet made: seed phrase, hardware, or social login?
Experience, not financial advice. $MANTRA
#MANTRAPausesUnstakingFor7DaysAfterKeplrSecurityIncident
On Nov 13, MANTRA paused new unstaking for 7 days. The waiting delay that protects stakers only works if the person pressing unstake is you.
Staking means locking your coins to help run a blockchain. To get them out, you "unstake" and wait (8 days on MANTRA).
How it got here?
> Keplr, a popular wallet for Cosmos-based coins, lets you open an account with a seed phrase, a hardware device, or a Google or Apple login.
> With the Google or Apple login, a third-party service called Web3Auth generates your private key (the master password to your coins), not a phrase you wrote down.
> On Nov 6 a flaw at Web3Auth exposed some of those keys. Keplr's co-founder says it was not a hack of Keplr's code and estimates about 20% of Google and Apple login accounts were affected.
> Per MANTRA, thieves took the loose coins first, then started unstaking the staked ones. MANTRA froze their wallets by governance vote and paused new unstaking. It will reassess after 7 days.
Unstaking already underway is not paused. Per MANTRA, anyone with an unstake running must restake (redelegate) before the 8 days end, or the thief can claim it.
How big is it? Not settled. Bitquery traced about $6M moving out of 44,000+ wallets, but part was Web3Auth rescuing coins ahead of the thieves. GoPlus counts at least about $1M stolen. No final total or refund plan yet.
Quick check, per Keplr's advice:
- Seed phrase and hardware wallet accounts were not affected. Google or Apple login accounts were.
- If yours is a social login: stop depositing and move loose coins to a seed phrase or hardware account.
- Ignore DMs and links offering "recovery help". Trust only official Keplr and Web3Auth posts.
What to watch? MANTRA's review, about Nov 20 UTC. Lifted, extended, or explained?
Whoever holds the key controls the lock.
How was your wallet made: seed phrase, hardware, or social login?
Experience, not financial advice. $MANTRA
#MANTRAPausesUnstakingFor7DaysAfterKeplrSecurityIncident
