MANTRA Halts Unbonding for Seven Days After Web3Auth and Keplr Exploit

MANTRA has suspended new token unbonding transactions for seven days following an exploit of Web3Auth and Keplr wallets that let attackers access users' private keys and unstake their MANTRA holdings. The project announced the measure on Friday and said it will reassess the freeze after the seven-day window closes.

The attack path bypassed MANTRA's own contracts entirely. Attackers compromised third-party wallet infrastructure, obtained private keys, and initiated unbonding of staked tokens without owners' consent after draining their liquid MANTRA balances. MANTRA stated that community members reported the unauthorized activity, which prompted the emergency response.

What has MANTRA done so far?

The protocol has already frozen several wallets linked to the attackers through Governance Proposal 41, using its on-chain governance mechanism as an enforcement tool. MANTRA said it is coordinating with Web3Auth and Keplr on recovery efforts for affected users.

The seven-day suspension covers new unbonding requests. MANTRA reserved the right to impose additional pauses depending on how the situation develops, leaving open the possibility of an extension if the exploit remains active when the initial window expires.

Why halt unbonding at all?

The logic is operational, not cosmetic. Proof-of-stake unbonding typically follows a fixed delay between a user's request and the moment tokens become liquid. If attackers hold stolen keys and can submit unstaking requests freely, a protocol-level pause on new unbonding creates a bottleneck: tokens already compromised cannot complete the final step toward liquidity during the freeze window.

That converts a wallet-security incident into a race against the unbonding clock. By halting new requests, MANTRA buys time to identify attacker-controlled addresses, coordinate with the two wallet providers, and potentially recover funds before they exit the staking layer entirely.

The intervention also carries costs. Legitimate users who want to unstake during the seven-day period cannot submit new requests, a trade-off the project accepted to contain the attack. The move mirrors a broader pattern in proof-of-stake networks, where governance-controlled emergency powers function as the last line of defense when front-end or key-management infrastructure fails upstream of the chain itself.

Who is actually at fault here?

The incident exposes the fault line between protocol security and wallet security. Web3Auth and Keplr sit outside MANTRA's control, yet a compromise at that layer directly threatened the protocol's staking economics and forced an emergency governance action. MANTRA becomes the party absorbing the operational consequences — halted unstaking, frozen wallets, and recovery negotiations — for a vulnerability it did not ship.

For users, the distinction matters for any recovery process. MANTRA has committed to working with both providers, but the outcome of those efforts remains unresolved, and the project has not stated what proportion of affected funds might be recovered.

The immediate checkpoint is the seven-day reassessment, when MANTRA must decide whether the freeze has contained the attack or whether the attackers retain access to additional compromised keys.