MANTRA Suspends New Unstaking for Seven Days After Web3Auth Key Leak

MANTRA has paused all new unstaking transactions for seven days after attackers stole users' unstaked MANTRA (OM) tokens and began unstaking staked holdings without authorization. The protocol disclosed the incident on Tuesday and tied it to a private-key leak stemming from Web3Auth infrastructure.

The vulnerability exposed private keys for some Keplr wallet users in the Cosmos ecosystem who signed in through Google or Apple accounts, according to MANTRA's statement. Attackers used the exposed credentials to move unstaked tokens out of user wallets and to initiate unauthorized unstaking requests on staked positions.

What does the pause cover?

The seven-day freeze applies only to new unstaking requests. Transactions already underway will proceed through their existing eight-day unstaking period, which means tokens in that queue remain exposed if an attacker initiated the request.

MANTRA instructed affected users to redelegate their tokens before the eight-day period ends. Redelegation blocks attackers from claiming the tokens at the end of the window and moving them to addresses outside users' control. Once a user redelegates, any further unstaking from that position stays locked for the duration of the freeze.

The protocol set two operational parameters for the response:

• New unstaking requests: suspended for seven days from the announcement.
• Existing requests: unaffected, subject to the standard eight-day unbonding window.
• Redelegation: available and recommended as the defensive action for affected accounts.

MANTRA said it will reassess the pause after seven days and reserves the right to extend it if the underlying security issue persists.

Why Web3Auth sits at the center

Web3Auth provides key-management infrastructure that lets wallet users authenticate through mainstream accounts such as Google and Apple rather than managing seed phrases directly. The compromise means the failure did not originate in MANTRA's own staking contracts but in the authentication layer that generated or held private keys for a subset of Keplr users.

That distinction matters for liability and remediation. MANTRA cannot reverse thefts that occurred through compromised keys, because the attacker signed valid transactions from the users' own wallets. The protocol's available lever is procedural: it can slow or halt the unbonding pipeline so that stolen staked positions do not complete the eight-day cycle that would make the tokens liquid and transferable.

The redelegation instruction exploits exactly that timing. An attacker who initiated an unauthorized unstaking request cannot claim the tokens if the legitimate holder re delegates the stake before the unbonding period expires, because the redelegation cancels the attacker's claim path on those assets.

What comes next

The immediate deadline for affected users is structural rather than administrative: each compromised unstaking request reaches the end of its eight-day window on its own schedule, and redelegation must happen before that point to be effective. Users who fail to redelegate in time face the loss of those tokens once the attacker claims and transfers them.

For the broader Cosmos ecosystem, the incident puts fresh pressure on key-management vendors that broker custody through OAuth-style logins, a model that trades self-custody guarantees for onboarding convenience. MANTRA's reassessment in seven days will determine whether the freeze ends or extends into a longer containment window.