MANTRA Chain Halted After Cosmos EVM Exploit as Token Hit Record Low

MANTRA Chain went fully offline after its team detected an attacker exploiting a vulnerability in an upstream dependency used by the network. The halt froze validators, public endpoints, transactions, bridges, and deposits and withdrawals, turning a security incident into a complete operational stoppage while developers prepared a verified fix.

What happened to MANTRA Chain?

MANTRA initially described the shutdown as a precaution while its engineering and security teams investigated. Subsequent updates said the incident had been isolated to the chain’s Cosmos EVM module and that the immediate threat had been contained. Reporting identified the vulnerable component as the ICS20 precompile, which connects EVM-based smart-contract activity with Cosmos Inter-Blockchain Communication transfers.

The mainnet remained halted at block 17,449,398. MANTRA’s status update said the team captured a full state snapshot before stopping the chain, preserving the network’s state for remediation and recovery work.

How did the incident affect the MANTRA token?

The disruption quickly hit the native MANTRA token. Reported market data showed an approximately 18.5% decline, from around $0.005060 to an intraday low near $0.004126. Trading volume rose nearly 600% to about $24 million, indicating intense activity as traders reacted to the exploit and the loss of on-chain functionality.

The price move occurred even though trading on centralized venues could continue in some cases. With the MANTRA network offline, however, on-chain transfers and exchange deposits and withdrawals were suspended or restricted, separating market trading from the ability to move assets through the blockchain.

How many wallets were affected, and what did MANTRA say about user funds?

MANTRA said the exploit affected two wallet addresses before containment. The project also said that no third-party user, exchange, or partner funds were directly impacted.

That statement is the project’s current incident assessment rather than a completed independent audit. The distinction matters: a claim that user funds were safe describes what MANTRA reported at the time, while a post-mortem and external review would provide a fuller account of the exploit path, assets involved, and controls that failed or held.

What steps did the team take to contain the threat?

The response focused on preventing additional value from moving while investigators isolated the vulnerability. MANTRA:

• paused validators and public RPC endpoints;
• froze transactions and other chain activity;
• suspended bridge operations and exchange deposits and withdrawals; and
• took a complete state snapshot before the halt.

The team then identified the root cause, reviewed known attack vectors, and prepared v8.4.0, a patched release intended to address the Cosmos EVM vulnerability. The release was tested through a dry run on the DuKong testnet, with the mainnet still offline while final security reviews were completed.

How was the restart supposed to work?

MANTRA’s plan called for a coordinated validator restart rather than individual operators bringing nodes back online independently. Validators were instructed to follow the official upgrade process and wait for the scheduled mainnet upgrade. The project said dry-run testing had succeeded, but the network was still awaiting final security checks and coordinated restart preparations in the latest update provided.

That sequence is significant for a halted proof-of-stake network: restoring nodes before the patch, validation, and coordination steps are complete could reintroduce the vulnerability or create inconsistent chain state. The status updates therefore made restoration conditional on remediation and review, not simply on bringing block production back online.

Why users should watch for recovery scams

A network outage creates an opportunity for impersonators to contact holders with fake recovery instructions. Users should treat unsolicited messages asking for a seed phrase, private key, wallet “validation,” or a transfer to a recovery address as suspicious.

A legitimate network restart should not require a user to disclose wallet credentials or send assets to an address controlled by a supposed support representative. The safest course is to rely on MANTRA’s official status updates and verified upgrade instructions rather than links or direct messages sent during the disruption.

How does the halt fit MANTRA’s broader history?

The incident arrived during an already sensitive period for the project. In April 2025, the former OM token suffered a collapse of more than 90%, falling from roughly $6.30 to below $0.50 in contemporaneous reporting. MANTRA attributed that episode to forced exchange liquidations, while other observers questioned the explanation.

The project later transitioned from OM to MANTRA through a non-dilutive 1:4 token split at block 13,000,000: each OM became four MANTRA tokens, with the total supply expanding proportionally.

Inveniam Capital Partners had also announced plans to acquire MANTRA and affiliated entities, combining Inveniam’s private-market data infrastructure with MANTRA’s regulated blockchain and tokenized-asset infrastructure. The acquisition context did not change the immediate technical problem: the market’s near-term focus was whether the patched network could restart safely and whether exchange transfers would reopen.

What the market was watching next

The key signals were straightforward:

1. A safe mainnet restart: v8.4.0 needed to pass final security review and be deployed through the coordinated validator process.
2. Restored exchange functionality: deposits and withdrawals needed to resume after the chain was considered safe.
3. A detailed post-mortem: users and markets needed a clear explanation of the exploit path, the two affected addresses, the remediation, and the controls intended to prevent a repeat.

Until those milestones were met, the central risk was not ordinary token volatility. It was the reliability of the network itself—and whether MANTRA could restore both chain operations and confidence after another major security and credibility test.