MANTRA Chain released a review of the August 20 security incident, confirming that attackers exploited an unsigned integer underflow in the upstream dependency cosmos/evm balance accounting layer to unauthorizedly transfer a total of 720,923,967.99 MANTRA from two addresses, equivalent to approximately $3.6 million at pre-attack prices.

Of this, 600,000,035.56 MANTRA was transferred from the on-chain burn address, and 120,923,932.44 MANTRA was transferred from the multi-signature related to the genesis incentive. The project stated that there was no involvement of validator keys, administrators, governance, or multi-signature signers being leaked; attackers did not require privileges and could complete the attack by deploying permissionless contracts and self-funding wallets.

The first abnormal transfer occurred at 19:06 UTC on the 20th, with approximately 600 million MANTRA transferred from the burn address; another transfer of about 120.9 million MANTRA occurred at 22:59. The network stopped block production at 23:13 and resumed after upgrading to v8.4.0, with an interruption of 30 hours and 13 minutes. The English status page recorded a halt at block 17,449,398, with block production resuming around 05:30 UTC on August 22.

The vulnerability was not in the self-developed business code but in the module providing Ethereum Virtual Machine functionality for the Cosmos SDK: it still performed unsigned deductions and overflowed when the balance was insufficient, bypassing normal authorization. The same module also affected other chains like TAC and KiiChain that week, prompting Cosmos Labs to call for networks without patches to halt. The token briefly dropped about 18.5% to a record low of approximately $0.0041.

As of the 28th, funds had not been recovered. Approximately 37.96 million MANTRA (5.27% of the transferred amount) remained in the attacker's address, frozen due to the network halt and v8.4.0 restrictions, while the rest flowed to trading platforms and is under law enforcement investigation. Future measures will enhance monitoring of burn addresses and other "non-transferable" accounts and promote ecological improvements in vulnerability disclosure.

The buyers were traders who sold during the network halt window, while the sellers were project treasuries unable to access the stolen tokens. Funds flowed from the burn address and incentive multi-signatures to the attackers and then to exchanges. Beneficiaries included platforms that listed spot trading early and short sellers; those under pressure were holders writing real-world asset narratives on this layer-1 network. This is a shared module vulnerability, not a validator betrayal.

Source: Public Information