In a notice reported by ChainCatcher on November 13, 2026, at 19:53:02 UTC+8, MANTRA said a private-key exposure involving Web3Auth and Keplr wallets had allowed attackers to steal users’ liquid assets and, without their consent, request the release of their staked MANTRA tokens.
MANTRA said it had paused new undelegation transactions for seven days to prevent further losses and would reassess the pause afterward. Undelegation means requesting the release of staked tokens; the unbonding period is the wait before their release. Requests already underway were not affected by the pause. MANTRA said affected users needed to re-delegate before the eight-day unbonding period ended to prevent attackers from claiming the tokens.
MANTRA also said it had previously frozen several attacker wallets through governance proposal No. 41.