MANTRA Pauses Unstaking for 7 Days as Hackers Drain Keplr and Web3Auth Wallets

The MANTRA blockchain has paused withdrawals from staking for 7 days. The reason is an ongoing attack on Keplr and Web3Auth wallets: hackers who got the victims' private keys first stole their liquid MANTRA tokens and then started unstaking the rest without the owners' consent.

Why it matters

If you hold MANTRA in a Keplr wallet or a wallet created through Web3Auth, your tokens may be at risk. MANTRA's advice to affected users is to redelegate their staked tokens, that is, move the stake to another validator, before the 8-day unlock period ends. Redelegating cancels a pending withdrawal, so the hacker cannot take those tokens out.

The pause does not cancel withdrawals that were started before it. If you see an unstaking you didn't start, act before it completes.

What happened

Staked tokens are locked to help run the network and earn rewards. Getting them back takes an 8-day "unbonding" period on MANTRA. Hackers holding stolen keys were using that process to empty the staked part of the wallets as well.

MANTRA says it has already frozen several of the hackers' wallets through a governance vote, Proposal 41, and is helping Keplr and Web3Auth recover funds. Keplr is one of the most popular wallets for Cosmos-based networks. Web3Auth lets apps create wallets from an email or social login.

The sources did not say how many users were affected or how much was stolen.