MANTRA Chain has published a post-mortem on the security incident that froze its network on August 20, attributing the breach to an unsigned-integer underflow in the balance-accounting logic of the upstream Cosmos EVM stack it runs on. According to the retrospective, reported August 28 by PANews, the attacker used the flaw to move 720,923,967.99 MANTRA tokens out of a burn address and an old genesis-era multisig wallet without ever gaining privileged access to the chain. At the token's pre-incident spot price of roughly $0.005, the team values the moved tokens at approximately $3.6 million.
Highlights
- MANTRA's post-mortem blames an unsigned-integer underflow in the upstream Cosmos EVM balance-accounting layer for the Aug 20 incident.
- About 720.9 million MANTRA tokens moved from a burn address (~600M) and an old genesis-era multisig (~120.9M), valued near $3.6 million.
- The team says validator keys, admin keys, governance control, and multisig signers were never compromised, and no new tokens were minted.
- Because the moved tokens were previously non-circulating, roughly 720.9 million MANTRA now count toward circulating supply.
What the post-mortem says happened
The incident began on August 20, when MANTRA's mainnet stopped producing blocks after engineers detected anomalous activity tied to its Cosmos EVM module. The chain was halted while the team investigated, and the network later resumed operations on a patched binary. The post-mortem published over a week later is the team's fullest account yet of what the attacker actually did: rather than breaching validator infrastructure or an admin key, the exploit worked purely by manipulating how the balance ledger tracked token amounts, letting an underflow condition credit the attacker with tokens that should have remained locked away in non-circulating addresses.
The underflow, and where the tokens came from
Per the post-mortem, the root defect sits in the balance-accounting layer shared across Cosmos EVM deployments, where an unsigned integer subtraction could wrap around to an enormous positive value instead of erroring out when a balance calculation went below zero — a classic underflow bug. Independent reporting on the broader Cosmos EVM issue has described a related mechanism, in which the staking precompile miscalculates a balance written back to the EVM after a delegation, a flaw that reportedly also touched other Cosmos EVM chains around the same period. Of the 720.9 million MANTRA tokens moved, MANTRA says about 600 million came out of a burn address and about 120.9 million came from an old multisig wallet dating to the network's genesis.
Related: Solana Begins Testnet Rollout of SIMD-0437, Targeting a 90% Rent Cut
What it means for MANTRA and circulating supply
MANTRA's team was emphatic that this was not a conventional hack: no validator keys, admin keys, governance mechanisms, or multisig signers were compromised, and the company says no funds were deducted from customer accounts, exchange balances, deposit addresses, or application contracts. No new MANTRA tokens were minted in the process. Still, the practical effect on tokenomics is real. Because the burn address and the old multisig were both counted as non-circulating, the roughly 720.9 million tokens that moved are now considered part of circulating supply — a shift that matters for anyone tracking MANTRA's market capitalization or valuing the token against its stated supply schedule. For a token already trading near record lows following the network halt, an unplanned addition to floating supply is the kind of detail holders and exchanges will want reflected in their models.
A bigger warning for Cosmos EVM chains
The MANTRA incident arrived alongside similar exploits on other Cosmos EVM-based networks in the same window, underscoring that the underlying defect was not unique to MANTRA's implementation but rather a shared-dependency risk across the ecosystem. That pattern is a reminder that chains built on common upstream modules inherit not just functionality but also vulnerability surface, and that a single accounting bug can ripple across otherwise-unrelated networks almost simultaneously. For MANTRA specifically, the next things to watch are whether further audits of the patched Cosmos EVM binary turn up related issues, whether the team or upstream Cosmos Labs publishes additional technical disclosure on the two other contributing defects referenced in coverage of the wider incident, and how MANTRA addresses the supply-accounting implications of tokens that unexpectedly left non-circulating status.
