$1.01 million, 5 days, $0: By the time white-hat hackers stepped in to help, $1.01 million was already gone; the official acknowledgment came 5 days too late; and to this day, not a single cent of the stolen money has made it back to the victims.
The two posts at #MANTRA因Keplr安全事件暂停解除质押7天 13 and 16:00 covered the incident itself. This one is just about what you should do now. First, a personal note: when I checked the mints at noon today, I stopped two transactions—Kryntar and Pengu. One had a mandatory 0.00005 BNB fee hidden behind the word “free”; the other had a prize pool that was actually zero and had never been funded. Scammers love to show up at times like this: the official recovery process hasn’t been announced yet, so anyone asking you to click a link to “claim your stolen funds back” is a scammer.
Do these three things now:
① Check how you logged in: only Keplr wallets created by signing in with Google or Apple may be affected. Wallets created with a seed phrase or hardware wallet are safe. Torus Wallet is also affected (Web3Auth update, November 13). Don’t wait for a notification—check for yourself how you created your wallet.
② If you’re currently undelegating, act within the 8-day window: an MANTRA undelegation already in progress can’t be stopped. You must redelegate before the 8 days are up, or the tokens will go to the hackers. New undelegations have been paused for 7 days, with a review on November 20.
③ Don’t send more money or click recovery links: Web3Auth says logins have been restored, but the recovered funds are still being held by them. The return process will be announced “in the coming days.” Until then, anyone telling you to “click a link to claim your stolen funds” is a scammer. And don’t transfer any more money into that wallet.
My take: the most important thing to remember isn’t the 7-day pause—it’s the 5-day gap from November 1 to November 6. When a wallet is compromised, your money keeps disappearing every day until the official acknowledgment comes. By the time the rescue team stepped in, $1.01 million was already gone. Counting on an announcement to save you means giving the hackers more time for free. So don’t wait until the November 20 review to act: check your login method and undelegation status today. I’ll change my mind only when Web3Auth announces the return process and actually starts paying people back. When that day comes, I’ll be checking the numbers immediately.
Have you ever been in a situation like this—knowing there might be a problem with your wallet, but putting off checking until you found out it was already too late?
Follow me. On November 20, the day of the review, I’ll check both things at once: whether undelegations have been cleared and whether the money has started coming back. —Baobao
The two posts at #MANTRA因Keplr安全事件暂停解除质押7天 13 and 16:00 covered the incident itself. This one is just about what you should do now. First, a personal note: when I checked the mints at noon today, I stopped two transactions—Kryntar and Pengu. One had a mandatory 0.00005 BNB fee hidden behind the word “free”; the other had a prize pool that was actually zero and had never been funded. Scammers love to show up at times like this: the official recovery process hasn’t been announced yet, so anyone asking you to click a link to “claim your stolen funds back” is a scammer.
Do these three things now:
① Check how you logged in: only Keplr wallets created by signing in with Google or Apple may be affected. Wallets created with a seed phrase or hardware wallet are safe. Torus Wallet is also affected (Web3Auth update, November 13). Don’t wait for a notification—check for yourself how you created your wallet.
② If you’re currently undelegating, act within the 8-day window: an MANTRA undelegation already in progress can’t be stopped. You must redelegate before the 8 days are up, or the tokens will go to the hackers. New undelegations have been paused for 7 days, with a review on November 20.
③ Don’t send more money or click recovery links: Web3Auth says logins have been restored, but the recovered funds are still being held by them. The return process will be announced “in the coming days.” Until then, anyone telling you to “click a link to claim your stolen funds” is a scammer. And don’t transfer any more money into that wallet.
My take: the most important thing to remember isn’t the 7-day pause—it’s the 5-day gap from November 1 to November 6. When a wallet is compromised, your money keeps disappearing every day until the official acknowledgment comes. By the time the rescue team stepped in, $1.01 million was already gone. Counting on an announcement to save you means giving the hackers more time for free. So don’t wait until the November 20 review to act: check your login method and undelegation status today. I’ll change my mind only when Web3Auth announces the return process and actually starts paying people back. When that day comes, I’ll be checking the numbers immediately.
Have you ever been in a situation like this—knowing there might be a problem with your wallet, but putting off checking until you found out it was already too late?
Follow me. On November 20, the day of the review, I’ll check both things at once: whether undelegations have been cleared and whether the money has started coming back. —Baobao
