7 days, 8 days, $1.82 million: MANTRA hit pause on unstaking last night—but it can’t stop the tokens already in motion.
#MANTRA因Keplr安全事件暂停解除质押7天
This topic surged to No. 2 on the Plaza trending list at noon today, with 153 people discussing it (Plaza data captured at 12:57). Here’s what happened:
On November 6, a vulnerability was discovered in Web3Auth’s infrastructure. The service provider powers Google/Apple logins for Keplr, and the private keys of some wallets created using social logins were exposed. Wallets created with a recovery phrase or hardware wallet were unaffected. On November 7, a Keplr co-founder confirmed that Keplr’s own code wasn’t hacked—the issue originated with Web3Auth.
The hackers began their attack as early as November 1. An on-chain investigation by Bitquery, updated November 12, found that at least $1.82 million and 7,842 Cosmos wallets could be traced on-chain as part of the incident. Note that this is a lower-bound estimate for the entire theft involving Keplr social-login wallets. The official amount of OM stolen hasn’t been disclosed, so don’t attribute the full $1.82 million to OM.
On the evening of November 13, MANTRA issued a statement: in addition to stealing liquid OM from users’ wallets, the hackers also unstaked users’ staked OM without their consent. In response, all new unstaking requests were urgently paused on-chain for 7 days, with a review after 7 days and the possibility of an extension. Multiple hacker wallets had already been frozen through Governance Proposal 41.
Here’s the key point: the pause only blocks new unstaking requests; it doesn’t stop those already in progress. MANTRA’s unstaking period is 8 days. Tokens currently being unstaked must be redelegated before the period ends, or the hackers will be able to claim and transfer them as soon as it expires. After redelegation, any attempt to unstake again will also be blocked by the freeze. Web3Auth said today that logins have been restored, but the recovered funds haven’t been returned yet.
$OM is currently around $0.0669 (Binance OM/USDT, snapshot at 12:54 Beijing time), down about 5.1% from its intraday open of $0.0705.
My take: This 7-day pause is the most direct on-chain way to stop the bleeding. The hackers have the private keys, so conventional measures can’t stop them from unstaking; the only option is to shut the exit for now. But the pause only protects tokens that haven’t been moved yet. MANTRA has explicitly said it can’t stop tokens already in the 8-day unstaking process—you can only try to recover them by redelegating them yourself. So if you created a wallet using Keplr’s Google/Apple login and have staked OM, your first priority shouldn’t be checking how much OM has fallen. Check whether any of your tokens are currently being unstaked, and if they are, redelegate them immediately. I’ll revise my view if MANTRA’s review after 7 days lifts the pause and Web3Auth announces a channel for returning the stolen funds.
If your staked tokens were caught up in something like this, would you redelegate them immediately to lock them back up, or leave them untouched and wait for the review after 7 days?
I’ll check the details as soon as the review happens in 7 days—whether the pause is extended or lifted, and whether a channel for returning the stolen funds has opened. Follow me, and you won’t have to keep watch for the announcement yourself.
—Baobao
#MANTRA因Keplr安全事件暂停解除质押7天
This topic surged to No. 2 on the Plaza trending list at noon today, with 153 people discussing it (Plaza data captured at 12:57). Here’s what happened:
On November 6, a vulnerability was discovered in Web3Auth’s infrastructure. The service provider powers Google/Apple logins for Keplr, and the private keys of some wallets created using social logins were exposed. Wallets created with a recovery phrase or hardware wallet were unaffected. On November 7, a Keplr co-founder confirmed that Keplr’s own code wasn’t hacked—the issue originated with Web3Auth.
The hackers began their attack as early as November 1. An on-chain investigation by Bitquery, updated November 12, found that at least $1.82 million and 7,842 Cosmos wallets could be traced on-chain as part of the incident. Note that this is a lower-bound estimate for the entire theft involving Keplr social-login wallets. The official amount of OM stolen hasn’t been disclosed, so don’t attribute the full $1.82 million to OM.
On the evening of November 13, MANTRA issued a statement: in addition to stealing liquid OM from users’ wallets, the hackers also unstaked users’ staked OM without their consent. In response, all new unstaking requests were urgently paused on-chain for 7 days, with a review after 7 days and the possibility of an extension. Multiple hacker wallets had already been frozen through Governance Proposal 41.
Here’s the key point: the pause only blocks new unstaking requests; it doesn’t stop those already in progress. MANTRA’s unstaking period is 8 days. Tokens currently being unstaked must be redelegated before the period ends, or the hackers will be able to claim and transfer them as soon as it expires. After redelegation, any attempt to unstake again will also be blocked by the freeze. Web3Auth said today that logins have been restored, but the recovered funds haven’t been returned yet.
$OM is currently around $0.0669 (Binance OM/USDT, snapshot at 12:54 Beijing time), down about 5.1% from its intraday open of $0.0705.
My take: This 7-day pause is the most direct on-chain way to stop the bleeding. The hackers have the private keys, so conventional measures can’t stop them from unstaking; the only option is to shut the exit for now. But the pause only protects tokens that haven’t been moved yet. MANTRA has explicitly said it can’t stop tokens already in the 8-day unstaking process—you can only try to recover them by redelegating them yourself. So if you created a wallet using Keplr’s Google/Apple login and have staked OM, your first priority shouldn’t be checking how much OM has fallen. Check whether any of your tokens are currently being unstaked, and if they are, redelegate them immediately. I’ll revise my view if MANTRA’s review after 7 days lifts the pause and Web3Auth announces a channel for returning the stolen funds.
If your staked tokens were caught up in something like this, would you redelegate them immediately to lock them back up, or leave them untouched and wait for the review after 7 days?
I’ll check the details as soon as the review happens in 7 days—whether the pause is extended or lifted, and whether a channel for returning the stolen funds has opened. Follow me, and you won’t have to keep watch for the announcement yourself.
—Baobao
