November 1, November 6, November 20: In 13 days, the Keplr theft unfolded in three steps—the first funds were stolen on November 1, the company didn’t acknowledge it until November 6, and MANTRA hit pause on November 13. The fourth step, “returning the money,” still doesn’t even have a date as of tonight.
#MANTRA因Keplr安全事件暂停解除质押7天 Let’s be clear about one thing: this wasn’t an exchange hack. A login provider’s credentials were leaked—the wallets targeted were those opened with one-click Google or Apple sign-in. Bitcoin is trading at around $66,600 tonight (Finnhub, 21:28 Beijing time), still below its 200-week moving average. But this piece isn’t about the broader market; it lays out those 13 days and tallies three things.
The first theft happened at 12:13 p.m. ET on November 1. The earliest transaction visible in Bitquery’s on-chain investigation: TIA from a Keplr wallet on the Celestia chain was bridged via Squid into an Ethereum address controlled by the hacker. For the next five days, no one said a word. By the time white hats stepped in to rescue the funds, $1.01 million was already gone.
At 16:13 ET on November 6, Web3Auth publicly acknowledged a security issue with its infrastructure: private keys for some embedded wallets created by signing in with Google or Apple had been exposed. It immediately suspended embedded wallet services. At 03:29 ET on November 7, Keplr co-founder Josh Lee confirmed that Web3Auth was the source.
White hats rescued funds from November 7 to 8. By 10:38 a.m. ET on November 7, the rescue wallets operated by Web3Auth held about $6 million. On November 8, The Block verified 12 publicly disclosed rescue addresses containing about $5.6 million in total, including about 2.49 million ATOM worth roughly $3.3 million. The company said the recovered funds were “safely held,” but no one has given a date for how or when they’ll be returned.
At 18:58 ET on November 10, Web3Auth issued another statement: white hat efforts were continuing, and the return process would be announced in the “coming days.” Four days have passed since then, and there’s still no sign of the process.
On November 12, Bitquery published its third investigation update: at least $1.82 million stolen, involving 7,842 Cosmos wallets, 52 Ethereum wallets, and 13 Hyperliquid accounts. The latest attacker transaction was at 7:05 a.m. ET on November 12. Note: Keplr and Web3Auth still haven’t disclosed their total losses, and MANTRA hasn’t disclosed how much OM was stolen—so claims that “the $1.82 million was OM” are wrong. The $1.82 million is the minimum amount stolen in the overall social-login wallet theft.
At 10:28 UTC on November 13, MANTRA issued an official statement: after stealing liquid tokens, the hacker was unbonding victims’ staked tokens without their consent. An emergency on-chain pause halted all new unbondings for seven days, with a review after seven days and the option to extend. Governance Proposal 41 (the v8.8.0 coordinated security upgrade) has frozen several hacker wallets. But the pause only blocks new unbondings—it doesn’t affect those already underway. You must redelegate within the eight-day unbonding period to reclaim those tokens; otherwise, they’ll go to the hacker.
On November 14, Web3Auth announced an update: existing users can log in again, but the rescued funds have not yet been returned. SDK v9 and earlier have been discontinued, and developers must upgrade to v10 or v11. New registrations on the Legacy network are expected to resume before November 23. Torus Wallet was also affected. The company also warned that return-related scams are already emerging: don’t trust links sent to you in DMs claiming to help you claim your funds, and never share your seed phrase or private keys.
December 14 is the next hurdle: Upbit and Bithumb will halt trading at 15:00 Korea time, cancel open orders, and suspend withdrawals until around January 13, 2027. Upbit had already listed MANTRA as a cautionary asset on August 21.
Three amounts—let’s get them straight before we go any further:
Stolen: at least $1.82 million, the minimum reported in Bitquery’s November 12 update. The official total is still undisclosed.
Rescued: about $6 million, the balance in the white hat wallets on November 7. The funds are “safely held” by the company.
Returned to victims: $0. As of 21:30 tonight, not a word has been announced about the return process.
Who should be worried, and who doesn’t need to be:
Should be worried: anyone with a Keplr wallet created by signing in with Google or Apple, Torus Wallet users, and users of third-party app wallets built on Web3Auth embedded wallets. MANTRA stakers should pay especially close attention: if your tokens are already being unbonded, redelegate within eight days—or the hacker will get them once unbonding ends.
Don’t need to worry: wallets created with a seed phrase and hardware wallets. Keplr has officially confirmed they’re unaffected.
One more price detail to correct: MANTRA is currently around $0.0026 (according to CoinGecko and CoinXview, around 21:30 tonight), down about 10.6% in 24 hours. It hit an all-time low of $0.002510 on November 13, down about 90% from its March 5 high of $0.02565, with a market cap of about $17.11 million. On March 2, 2026, MANTRA completed a 1:4 split: one old OM became four new MANTRA tokens. The $0.0669 OM/USDT price shown on some platforms is a stale quote for the old pre-split ticker, not the current price. The article published at 13:00 today used that old pricing; this is the correction based on the new figures.
Three things to watch next:
First, Web3Auth’s return process. They said “coming days” four days ago. Once it’s announced, look for three details: how to claim, how long it’ll take, and whether you need to do anything yourself.
Second, MANTRA’s review on November 20. Will the pause be lifted or extended? And if it’s lifted, will the unbondings that have been on hold for seven days suddenly flood through?
Third, the December 14 delisting and the Legacy network’s return to new registrations on November 23. Before the delisting, keep an eye on MANTRA’s liquidity on Korean exchanges and the withdrawal window, which runs until January 13, 2027. Don’t leave it until the last minute.
My take: the pause stops the bleeding; it doesn’t return the money. MANTRA has blocked new unbondings, but what will really determine whether victims get their money back is Web3Auth’s return process—and so far, it hasn’t even given a date. The lesson here isn’t about MANTRA; it’s about the habit of using “one-click login” to create a wallet. The price of avoiding 12 words is having someone else hold the keys. I’d change my view under either of two conditions: Web3Auth announces a specific return process and actually starts paying people back, or the November 20 review lifts the pause without any new thefts. On the other hand, if the return process still hasn’t materialized after December, or there’s a second wave of thefts, this isn’t over.
After all this, would you still use Google or Apple one-click login to create a wallet, or go back to writing down your seed phrase?
Follow me. As soon as Web3Auth announces its return process, I’ll break down how to claim and how long it’ll take. On November 20, I’ll also check whether the pause is lifted or extended.
Bao Bao