{"investigation":{"slug":"mantra-chain-upstream-exploit-august-2026","entity_name":"MANTRA Chain Upstream Exploit (August 2026)","trust_score":33,"severity_base":null,"score_modifier":0,"confidence":0.75,"status":"published","content_type":"investigation","summary":"On August 20, 2026, MANTRA Chain, an RWA-focused Cosmos-based Layer 1, halted block production for about 30 hours after an attacker exploited a critical vulnerability in its upstream Cosmos EVM module, the first in a wave of attacks on Cosmos EVM chains that also hit TAC and KiiChain. OM fell about 18% to a record low of $0.004126, and the chain resumed on August 22 on patched version 8.4.0. MANTRA said no user funds were exploited and that two project-managed wallets were affected; crypto.news reported about 720.9 million OM (roughly $3.6 million) drained from MANTRA. Sources disagree on which Cosmos EVM advisory was exploited and on how the fix was disclosed.","sections":[{"content":"According to the Cosmos Labs post-mortem, the first known attack on MANTRA Chain began at about 19:06 UTC on August 20, 2026. MANTRA halted block production at block 17,449,398 at about 23:13 UTC after detecting an active attacker exploiting a vulnerability in the Cosmos EVM module, an upstream dependency not developed by MANTRA. MANTRA said the incident affected two project-managed wallet addresses before it was contained. The halt froze user transactions, validators and endpoints, bridge operations via the MANTRA Migrate bridge, IBC relays, and exchange deposits and withdrawals; MEXC suspended MANTRA deposits and withdrawals, and South Korean exchange Upbit paused them citing the Virtual Asset User Protection Act, while spot trading continued. At 9:45 a.m. UTC on August 21, MANTRA said the root cause was isolated to the Cosmos EVM module. Block production resumed at about 05:30 UTC on August 22 after validators coordinated an upgrade to version 8.4.0, roughly 30 hours of downtime. MANTRA said v8.4.0 was tested on its DuKong testnet and in an internal mainnet-mirroring environment, that no state migrations or rollbacks were needed, and that user balances were not altered.","heading":"Incident Overview","sources":[{"url":"https://www.coindesk.com/tech/2026/08/21/mantra-token-plunges-18-to-record-low-as-blockchain-halts-after-exploit","name":"MANTRA token plunges 18% to record low as blockchain halts after exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md","name":"Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub","type":"official","credibility":1},{"url":"https://mpost.io/mantra-chain-halts-network-operations-after-detecting-upstream-vulnerability-freezing-all-transactions-and-withdrawals/","name":"MANTRA Chain Halts Network Operations After Detecting Upstream Vulnerability — Metaverse Post","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/21/mantra-chain-halts-network-unidentified-incident/","name":"MANTRA Chain Halts Network After Unidentified Incident — The Crypto Times","type":"news_article","credibility":2},{"url":"https://blockonomi.com/mantra-chain-restores-operations-following-30-hour-cosmos-evm-vulnerability-shutdown","name":"MANTRA Chain Restores Operations Following 30-Hour Cosmos-EVM Vulnerability Shutdown — Blockonomi","type":"news_article","credibility":2},{"url":"https://crypto.news/mantra-chain-resumes-blocks-after-cosmos-evm-fix/","name":"MANTRA Chain resumes blocks after Cosmos-EVM fix — crypto.news","type":"news_article","credibility":2},{"url":"https://cryip.co/mantra-chain-halt-attacker-exploit-vulnerability/","name":"MANTRA Chain Halts Network After Confirming Attacker Exploited Upstream Vulnerability — cryip.co","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/mantra-freezes-chain-falls-record-low-exploit/","name":"MANTRA Freezes Its Chain and Falls to a Record Low After Exploit — CoinPaprika","type":"news_article","credibility":2},{"url":"https://moneycheck.com/mantra-chain-restores-operations-following-extended-network-downtime-due-to-evm-security-flaw/","name":"MANTRA Chain Restores Operations Following Extended Network Downtime — MoneyCheck","type":"news_article","credibility":2}],"severity":"high"},{"content":"Sources disagree on which Cosmos EVM vulnerability was exploited. Cosmos Labs' official post-mortem identifies it as GHSA-7g4w-cg88-2cq2, two chained weaknesses in balance reconciliation between EVM state and the Cosmos SDK x/bank module: when vesting accounts delegated locked balances exceeding their spendable balances through the staking precompile, the StateDB SubBalance function underflowed, wrapping the attacker's balance to about 2^256; the attacker then used this inflated balance against a high-value target account (such as the zero address or a multisig), causing an overflow that transferred the target's entire balance to the attacker. Cosmos Labs said total token supply was effectively unchanged, with MANTRA's supply altered by one base unit. Versions below v0.6.2 or v0.7.2 were vulnerable. Other reporting (security advisory GHSA-54gx-3cgr-7mfm, The Defiant, Protos, DailyCVE, Endor Labs) describes the flaw as ASA-2026-002 (listed by DailyCVE as CVE-2026-ASA002), a critical bug in the ICS20 precompile, which lets EVM contracts initiate IBC cross-chain transfers: incorrect state handling during nested EVM execution meant state updates in recursive calls were not reflected in the outer context, letting an attacker reuse the same balance multiple times in one transaction; a fix (v0.6.0) was reported as released in March 2026. The same ICS20 vulnerability class is reported to have caused an estimated $7 million loss on Saga's EVM network in January 2026, where forged IBC messages were used to mint an uncollateralized stablecoin and bridge proceeds to Ethereum. It is unclear from the inputs whether these are two separate vulnerabilities or conflicting descriptions of one incident; the official post-mortem attributes the August 2026 attacks to GHSA-7g4w-cg88-2cq2.","heading":"The Vulnerability (Conflicting Identifications)","sources":[{"url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md","name":"Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub","type":"official","credibility":1},{"url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/","name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","credibility":2},{"url":"https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm","name":"ASA-2026-002 Security Advisory — cosmos/evm GitHub","type":"official","credibility":1},{"url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks","name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","credibility":2},{"url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains","name":"Cosmos Labs under fire over disclosure of bug affecting four blockchains — Protos","type":"news_article","credibility":2},{"url":"https://dailycve.com/cosmos-evm-state-handling-vulnerability-cve-2026-asa002-critical/","name":"Cosmos EVM State Handling Vulnerability CVE-2026-ASA002 — DailyCVE","type":"research","credibility":2},{"url":"https://www.endorlabs.com/vulnerability/ghsa-54gx-3cgr-7mfm","name":"GHSA-54gx-3cgr-7mfm: Cosmos EVM incorrect state handling during nested EVM execution — Endor Labs","type":"research","credibility":2},{"url":"https://www.techtimes.com/articles/325233/20260821/mantra-chain-hacked-via-cosmos-evm-bug-that-already-cost-saga-7m-january.htm","name":"MANTRA Chain Hacked Via Cosmos EVM Bug That Already Cost Saga $7M in January — TechTimes","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Both accounts describe upstream disclosure failures, though with different timelines. Per the Cosmos Labs post-mortem, GHSA-7g4w-cg88-2cq2 was reported through the Cosmos Bug Bounty Program on HackerOne on April 25, 2026; testing on 18-decimal configurations wrongly suggested no fund-loss risk on production chains. A fix was merged silently to the main branch on May 15, 2026 without saying which vulnerability it addressed, and patched releases (v0.6.2 and v0.7.2) were published on August 19, 2026 with vague security notes that did not signal urgency, about 20 hours before the first attack on MANTRA. MANTRA said 'twenty hours was not a realistic window in which to assess, build, test and coordinate' an upgrade across its 38 independent validators. At 07:16 UTC on August 20, hours before the first exploit, Push Chain publicly posted detailed exploit methodology and vulnerable release tags on GitHub (pushchain/push-chain-evm#40), attributed to a Hacken audit; the post-mortem called this 'highly unusual' and said it 'can increase the risk of an exploit', assessing it as likely to have accelerated attacker action. The other account says Cosmos Labs pushed the ASA-2026-002 fix (v0.6.0) publicly in March 2026 without advance private notice to downstream chains, under what was described as a 'silent patch model'. KiiChain's post-mortem stated: 'Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit.' Security researchers called the approach negligent, and the earlier Saga exploit raised questions about whether the patch was communicated urgently enough. These failures are attributed to the upstream Cosmos EVM maintainers and to Push Chain's public disclosure, not to MANTRA's own code.","heading":"Disclosure and Patch Coordination Failures","sources":[{"url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md","name":"Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub","type":"official","credibility":1},{"url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/","name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","credibility":2},{"url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains","name":"Cosmos Labs under fire over disclosure of bug affecting four blockchains — Protos","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/cosmos-labs-warns-of-security-incident-affecting-cosmos-evm-module-users","name":"Cosmos Labs Warns of Security Incident Affecting Cosmos EVM Module Users — KuCoin","type":"news_article","credibility":2},{"url":"https://blockonomi.com/cosmos-evm-vulnerability-triggers-emergency-shutdowns-across-multiple-chains","name":"Cosmos EVM Vulnerability Triggers Emergency Shutdowns Across Multiple Chains — Blockonomi","type":"news_article","credibility":2},{"url":"https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm","name":"ASA-2026-002 Security Advisory — cosmos/evm GitHub","type":"official","credibility":1},{"url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks","name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","credibility":2}],"severity":"high"},{"content":"Accounts of MANTRA's own losses differ. MANTRA stated that 'no user funds were exploited' and 'no assets belonging to users, exchange partners, or ecosystem collaborators were compromised', confirming only that two project-managed wallets were affected, and declined to disclose the activity in those wallets, the value at risk or whether assets were moved out. Separately, crypto.news reported that MANTRA lost about 720.9 million OM, worth roughly $3.6 million at the time. One source also reported that MANTRA (and Nesa) halted before user funds were exploited. MANTRA promised a comprehensive technical post-mortem 'within the next few days' after the August 22 restart, but none had been published as of August 27, 2026; undisclosed details include the exact attack method against MANTRA, what occurred in the two wallets, the amount of any extraction, and the downtime's financial effect on ecosystem partners. MANTRA acknowledged at restart that it was still assessing the full impact.","heading":"MANTRA's Losses and Disclosures","sources":[{"url":"https://crypto.news/mantra-chain-resumes-blocks-after-cosmos-evm-fix/","name":"MANTRA Chain resumes blocks after Cosmos-EVM fix — crypto.news","type":"news_article","credibility":2},{"url":"https://moneycheck.com/mantra-chain-restores-operations-following-extended-network-downtime-due-to-evm-security-flaw/","name":"MANTRA Chain Restores Operations Following Extended Network Downtime — MoneyCheck","type":"news_article","credibility":2},{"url":"https://mpost.io/mantra-chain-halts-network-operations-after-detecting-upstream-vulnerability-freezing-all-transactions-and-withdrawals/","name":"MANTRA Chain Halts Network Operations After Detecting Upstream Vulnerability — Metaverse Post","type":"news_article","credibility":2},{"url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/","name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","credibility":2},{"url":"https://beincrypto.com/cosmos-evm-security-incident-kiichain-tac-mantra/","name":"Cosmos Labs Confirms Cosmos EVM Incident as 3 Chains Disclose Impact — BeInCrypto","type":"news_article","credibility":2},{"url":"https://blockonomi.com/mantra-chain-restores-operations-following-30-hour-cosmos-evm-vulnerability-shutdown","name":"MANTRA Chain Restores Operations Following 30-Hour Cosmos-EVM Vulnerability Shutdown — Blockonomi","type":"news_article","credibility":2}],"severity":"high"},{"content":"OM fell about 18% (18.5% per one account) from about $0.005060 to a record low of $0.004126 around the halt, and trading volume rose about 600% to roughly $24 million in the following 24 hours as holders traded on exchanges where spot trading continued. By the following Friday OM had partly recovered to near $0.005 but remained about 80% below its March 2026 high of $0.0219. The record low came on top of a more than 90% collapse in April 2025.","heading":"Market Impact","sources":[{"url":"https://www.coindesk.com/tech/2026/08/21/mantra-token-plunges-18-to-record-low-as-blockchain-halts-after-exploit","name":"MANTRA token plunges 18% to record low as blockchain halts after exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://cryptorank.io/news/feed/64dce-mantra-price-crashes-18-as-exploit-forces-full-blockchain-halt","name":"MANTRA Price Crashes 18% as Exploit Forces Full Blockchain Halt — CryptoRank","type":"news_article","credibility":2},{"url":"https://dailycoin.com/mantra-chain-halts-network-after-exploit-as-token-hits-record-low","name":"MANTRA Chain Halts Network After Exploit as Token Hits Record Low — DailyCoin","type":"news_article","credibility":2},{"url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/","name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","credibility":2}],"severity":"high"},{"content":"MANTRA was the first of several Cosmos EVM chains attacked between August 20 and 25, 2026. Reports differ on the scale: coverage describes four affected chains (MANTRA, KiiChain, TAC and Nesa, with three drained), while the Cosmos Labs post-mortem counts six exploited chains, three beyond MANTRA, TAC and KiiChain, plus one further chain that reportedly halted before funds could be withdrawn. One account says 15 chains were running vulnerable code, six had the ICS20 precompile disabled, others mitigated in time, and at least three were exploited. TAC was exploited at about 19:46 UTC on August 22 and halted at block 24,671,475 after about 3 billion TAC (roughly $7.5 million) was drained from a single account, described as its staking contract. KiiChain was attacked from about 21:00 UTC on August 22; the attacker repeated the technique 18 times to drain 148,326,583.15 KII (reported as theoretically worth over $9 million but sold for about $1.6 million in BUSD, crashing the price). Reports differ on KiiChain's halt block (935 vs 9,355,723). Nesa halted preemptively without reported user losses. Across the six chains, the post-mortem tracked about $5.72 million converted into other assets: about $2.87 million via decentralized exchanges and about $2.85 million via centralized exchange accounts that were later frozen pending investigation. Drained assets across the ecosystem included 2,613,674.48 USDT, 114.129045 ETH, 93.78 TON, 1.393618 USDC and 98.87 OSMO. Reports differ on when Cosmos Labs urged all Cosmos EVM chains to have validators halt (August 22 vs August 24, with a broader advisory reported on August 25); at the time it declined to name the vulnerability, the chains or losses. Cosmos Labs coordinated with about 40 Cosmos chains through private channels and closed the active response window at 15:20 UTC on August 25.","heading":"Broader Cosmos EVM Attack Wave","sources":[{"url":"https://beincrypto.com/cosmos-evm-security-incident-kiichain-tac-mantra/","name":"Cosmos Labs Confirms Cosmos EVM Incident as 3 Chains Disclose Impact — BeInCrypto","type":"news_article","credibility":2},{"url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains","name":"Cosmos Labs under fire over disclosure of bug affecting four blockchains — Protos","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html","name":"Cosmos Labs Confirms Cosmos EVM Incident as 3 Chains Disclose Impact — Yahoo Finance","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/25/cosmos-labs-urges-evm-chains-to-halt-amid-security-incident/","name":"Cosmos Labs Urges Cosmos EVM Chains to Halt Validators, Three Now Offline — The Crypto Times","type":"news_article","credibility":2},{"url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/","name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","credibility":2},{"url":"https://crypto.news/cosmos-evm-chains-told-to-halt-after-security-incident/","name":"Cosmos EVM chains told to halt after security incident — crypto.news","type":"news_article","credibility":2},{"url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md","name":"Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub","type":"official","credibility":1},{"url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks","name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","credibility":2},{"url":"https://ground.news/article/cosmos-had-known-the-bug-since-april-a-valuation-error-leads-to-a-57-million-out-of-six-blockchain-exploit","name":"Cosmos EVM Vulnerability Drains MANTRA, TAC and KiiChain — Ground News / crypto.news aggregate","type":"news_article","credibility":2},{"url":"https://etherworld.co/august-2026-among-worst-months-for-defi-hacks/","name":"August 2026 Among Worst Months for DeFi Hacks — EtherWorld","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The August 2026 exploit followed other severe events. On April 13, 2025, OM collapsed more than 90% within about an hour, from around $6.30 to under $0.50, erasing over $5.4 billion in market capitalization. MANTRA's leadership attributed the crash to 'reckless forced liquidations' by centralized exchanges during low-liquidity hours. OKX pointed to major tokenomics changes since October 2024 and reported large coordinated deposits and withdrawals by on-chain addresses across centralized exchanges since March 2025. Some reports cited a wallet associated with co-founder John Patrick Mullin as depositing tokens to OKX before the collapse; Mullin disputed that team tokens were moved. No regulatory action or adjudicated finding of market manipulation has been publicly confirmed. Mullin pledged to burn 150 million OM from his own holdings as part of a recovery plan (CoinDesk reported a 160M OM burn plan). MANTRA later rebranded and redenominated its token in March 2026. The August 2026 incident is an exploit of an upstream dependency rather than of MANTRA's own code, a distinction relevant to assessing team competence versus systemic infrastructure risk; the April 2025 collapse is documented separately under the 'mantra-chain' entry.","heading":"Prior History: April 2025 OM Collapse and Redenomination","sources":[{"url":"https://www.forbes.com/sites/aliceliu/2025/04/14/mantras-54-billion-crash-how-supply-control-led-to-disaster/","name":"MANTRA's $5.4B Crash: How Supply Control Set the Stage for Disaster — Forbes","type":"news_article","credibility":1},{"url":"https://www.crowdfundinsider.com/2025/04/238682-mantras-om-crypto-token-crash-liquidity-issues-market-manipulation-allegations-recovery-plans/","name":"Mantra OM Token Crash: Liquidity Issues, Market Manipulation Allegations, Recovery Plans — Crowdfund Insider","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/mantra-om-token-collapsed-24-hours","name":"How Mantra's OM token collapsed in 24 hours of chaos — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://mantrachain.io/resources/announcements/statement-of-events-13-april-2025","name":"Statement of Events: 13th April 2025 — MANTRA Official","type":"official","credibility":2},{"url":"https://www.coindesk.com/markets/2025/04/22/mantra-to-burn-160m-om-tokens-50-from-daos-founder-following-90-price-crash","name":"Mantra to Burn 160M OM Tokens Following 90% Price Crash — CoinDesk","type":"news_article","credibility":1},{"url":"https://coinpaprika.com/news/mantra-freezes-chain-falls-record-low-exploit/","name":"MANTRA Freezes Its Chain and Falls to a Record Low After Exploit — CoinPaprika","type":"news_article","credibility":2},{"url":"https://cryip.co/mantra-chain-halt-attacker-exploit-vulnerability/","name":"MANTRA Chain Halts Network After Confirming Attacker Exploited Upstream Vulnerability — cryip.co","type":"news_article","credibility":2},{"url":"https://etherworld.co/august-2026-among-worst-months-for-defi-hacks/","name":"August 2026 Among Worst Months for DeFi Hacks — EtherWorld","type":"news_article","credibility":2}],"severity":"high"},{"content":"In June 2026, Inveniam Capital Partners announced an agreement to acquire MANTRA and its affiliates, following a $20 million strategic investment in MANTRA in August 2025. Reports differ on the expected close: initially targeted by June 30, 2026, versus expected in Q3 2026 at the time of the exploit, when the deal was reportedly in its closing stages. Inveniam indicated it was proceeding after the exploit. The combined entity plans to keep the MANTRA brand, with MANTRA Chain, its gas token, MANTRA Finance and mantraUSD as core infrastructure. Financial terms have not been disclosed.","heading":"Acquisition Context: Inveniam Capital Partners","sources":[{"url":"https://www.globenewswire.com/news-release/2026/06/16/3312813/0/en/inveniam-to-acquire-mantra-combining-tokenized-asset-infrastructure-with-ai-ready-private-market-data.html","name":"Inveniam to Acquire MANTRA, Combining Tokenized Asset Infrastructure with AI-Ready Private Market Data — GlobeNewswire","type":"official","credibility":1},{"url":"https://news.bitcoin.com/inveniam-capital-partners-pushes-mantra-acquisition-after-20m-bet-cementing-rwa-ai-stack/","name":"Inveniam Capital Partners Pushes Mantra Acquisition After $20M Bet — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/mantra-freezes-chain-falls-record-low-exploit/","name":"MANTRA Freezes Its Chain and Falls to a Record Low After Exploit — CoinPaprika","type":"news_article","credibility":2}],"severity":"low"}],"timeline":[{"date":"2025-04","event":"OM collapses more than 90% in about an hour, erasing over $5.4 billion in market capitalization.","source":"Forbes","source_url":"https://www.forbes.com/sites/aliceliu/2025/04/14/mantras-54-billion-crash-how-supply-control-led-to-disaster/"},{"date":"2026-01","event":"Saga EVM network suffers an estimated $7 million exploit via the ICS20 precompile vulnerability class; forged IBC messages used to mint an uncollateralized stablecoin.","source":"TechTimes","source_url":"https://www.techtimes.com/articles/325233/20260821/mantra-chain-hacked-via-cosmos-evm-bug-that-already-cost-saga-7m-january.htm"},{"date":"2026-03","event":"Cosmos Labs reportedly releases Cosmos EVM v0.6.0 patching ASA-2026-002 without advance private notice to downstream chains.","source":"ASA-2026-002 Security Advisory — cosmos/evm GitHub","source_url":"https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm"},{"date":"2026-04","event":"GHSA-7g4w-cg88-2cq2 reported through the Cosmos Bug Bounty Program on HackerOne; initially assessed as not affecting production chains.","source":"Cosmos EVM Post-Mortem — cosmos/security GitHub","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-05","event":"Silent fix merged to the Cosmos EVM main branch without identifying the vulnerability.","source":"Cosmos EVM Post-Mortem — cosmos/security GitHub","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-06","event":"Inveniam Capital Partners announces agreement to acquire MANTRA following a $20 million strategic investment.","source":"GlobeNewswire","source_url":"https://www.globenewswire.com/news-release/2026/06/16/3312813/0/en/inveniam-to-acquire-mantra-combining-tokenized-asset-infrastructure-with-ai-ready-private-market-data.html"},{"date":"2026-08","event":"Patched Cosmos EVM releases v0.6.2 and v0.7.2 published with vague security notes, about 20 hours before the first attack.","source":"crypto.news","source_url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"date":"2026-08","event":"At 07:16 UTC, Push Chain publicly posts exploit methodology and vulnerable release tags on GitHub (pushchain/push-chain-evm#40).","source":"Cosmos EVM Post-Mortem — cosmos/security GitHub","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-08","event":"First known attack on MANTRA Chain begins at about 19:06 UTC.","source":"Cosmos EVM Post-Mortem — cosmos/security GitHub","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-08","event":"MANTRA halts block production at block 17,449,398 at about 23:13 UTC; transactions, endpoints, bridge operations and exchange deposits/withdrawals frozen.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/08/21/mantra-token-plunges-18-to-record-low-as-blockchain-halts-after-exploit"},{"date":"2026-08","event":"OM falls about 18% to a record low of $0.004126 on volume up about 600%; MEXC suspends deposits and withdrawals. At 9:45 a.m. UTC MANTRA says the root cause is isolated to the Cosmos EVM module affecting two wallets and that no user funds were exploited.","source":"The Crypto Times","source_url":"https://www.cryptotimes.io/2026/08/21/mantra-chain-halts-network-unidentified-incident/"},{"date":"2026-08","event":"MANTRA resumes block production at about 05:30 UTC on v8.4.0 after about 30 hours offline; no rollback.","source":"CoinPaprika","source_url":"https://coinpaprika.com/news/mantra-freezes-chain-falls-record-low-exploit/"},{"date":"2026-08","event":"TAC exploited at about 19:46 UTC and halted at block 24,671,475 after about 3 billion TAC (~$7.5M) drained; KiiChain attacked from about 21:00 UTC, with about 148.3 million KII drained across 18 attacks.","source":"The Crypto Times; Yahoo Finance","source_url":"https://www.cryptotimes.io/2026/08/25/cosmos-labs-urges-evm-chains-to-halt-amid-security-incident/"},{"date":"2026-08","event":"Cosmos Labs urges all Cosmos EVM chains to have validators halt, citing an ongoing security incident, and coordinates with about 40 chains (another account dates this call August 22).","source":"The Crypto Times","source_url":"https://www.cryptotimes.io/2026/08/25/cosmos-labs-urges-evm-chains-to-halt-amid-security-incident/"},{"date":"2026-08","event":"Cosmos Labs closes the active exploit response window at 15:20 UTC; about $5.72 million in losses tracked across six chains. Public criticism of the disclosure process grows.","source":"Cosmos EVM Post-Mortem — cosmos/security GitHub","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-08","event":"MANTRA has still not published its promised technical post-mortem; details of the two affected wallets remain undisclosed.","source":"Blockonomi","source_url":"https://blockonomi.com/mantra-chain-restores-operations-following-30-hour-cosmos-evm-vulnerability-shutdown"},{"date":"2026-08","event":"Cosmos Labs publishes its full post-mortem for GHSA-7g4w-cg88-2cq2, covering the underflow/overflow exploit chain, the disclosure failures and the Push Chain posting.","source":"Cosmos EVM Post-Mortem — cosmos/security GitHub","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2026/08/21/mantra-token-plunges-18-to-record-low-as-blockchain-halts-after-exploit","name":"MANTRA token plunges 18% to record low as blockchain halts after exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260916010732/https://www.coindesk.com/tech/2026/08/21/mantra-token-plunges-18-to-record-low-as-blockchain-halts-after-exploit","credibility":1,"archive_timestamp":"2026-09-16T01:07:32+00:00"},{"url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md","name":"Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub","type":"official","archive_url":"http://web.archive.org/web/20260908013933/https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md","credibility":1,"archive_timestamp":"2026-09-08T01:39:33+00:00"},{"url":"https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm","name":"ASA-2026-002 Security Advisory — cosmos/evm GitHub","type":"official","archive_url":"http://web.archive.org/web/20260727100543/https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm","credibility":1,"archive_timestamp":"2026-07-27T10:05:43+00:00"},{"url":"https://www.forbes.com/sites/aliceliu/2025/04/14/mantras-54-billion-crash-how-supply-control-led-to-disaster/","name":"MANTRA's $5.4B Crash: How Supply Control Set the Stage for Disaster — Forbes","type":"news_article","archive_url":"http://web.archive.org/web/20251219092325/https://www.forbes.com/sites/aliceliu/2025/04/14/mantras-54-billion-crash-how-supply-control-led-to-disaster/","credibility":1,"archive_timestamp":"2025-12-19T09:23:25+00:00"},{"url":"https://www.coindesk.com/markets/2025/04/22/mantra-to-burn-160m-om-tokens-50-from-daos-founder-following-90-price-crash","name":"Mantra to Burn 160M OM Tokens Following 90% Price Crash — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260726152311/https://www.coindesk.com/markets/2025/04/22/mantra-to-burn-160m-om-tokens-50-from-daos-founder-following-90-price-crash","credibility":1,"archive_timestamp":"2026-07-26T15:23:11+00:00"},{"url":"https://www.globenewswire.com/news-release/2026/06/16/3312813/0/en/inveniam-to-acquire-mantra-combining-tokenized-asset-infrastructure-with-ai-ready-private-market-data.html","name":"Inveniam to Acquire MANTRA, Combining Tokenized Asset Infrastructure with AI-Ready Private Market Data — GlobeNewswire","type":"official","archive_url":"http://web.archive.org/web/20260626133526/https://www.globenewswire.com/news-release/2026/06/16/3312813/0/en/inveniam-to-acquire-mantra-combining-tokenized-asset-infrastructure-with-ai-ready-private-market-data.html","credibility":1,"archive_timestamp":"2026-06-26T13:35:26+00:00"},{"url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html","name":"Cosmos Labs Confirms Cosmos EVM Incident as 3 Chains Disclose Impact — Yahoo Finance","type":"news_article","archive_url":"http://web.archive.org/web/20260827222032/https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html","credibility":1,"archive_timestamp":"2026-08-27T22:20:32+00:00"},{"url":"https://beincrypto.com/cosmos-evm-security-incident-kiichain-tac-mantra/","name":"Cosmos Labs Confirms Cosmos EVM Incident as 3 Chains Disclose Impact — BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks","name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","archive_url":"http://web.archive.org/web/20260911215258/https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks","credibility":2,"archive_timestamp":"2026-09-11T21:52:58+00:00"},{"url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains","name":"Cosmos Labs under fire over disclosure of bug affecting four blockchains — Protos","type":"news_article","archive_url":"http://web.archive.org/web/20260825162732/https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains/","credibility":2,"archive_timestamp":"2026-08-25T16:27:32+00:00"},{"url":"https://crypto.news/mantra-chain-resumes-blocks-after-cosmos-evm-fix/","name":"MANTRA Chain resumes blocks after Cosmos-EVM fix — crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260824012447/https://crypto.news/mantra-chain-resumes-blocks-after-cosmos-evm-fix/","credibility":2,"archive_timestamp":"2026-08-24T01:24:47+00:00"},{"url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/","name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260901043624/https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/","credibility":2,"archive_timestamp":"2026-09-01T04:36:24+00:00"},{"url":"https://crypto.news/cosmos-evm-chains-told-to-halt-after-security-incident/","name":"Cosmos EVM chains told to halt after security incident — crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260828175024/https://crypto.news/cosmos-evm-chains-told-to-halt-after-security-incident/","credibility":2,"archive_timestamp":"2026-08-28T17:50:24+00:00"},{"url":"https://blockonomi.com/mantra-chain-restores-operations-following-30-hour-cosmos-evm-vulnerability-shutdown","name":"MANTRA Chain Restores Operations Following 30-Hour Cosmos-EVM Vulnerability Shutdown — Blockonomi","type":"news_article","archive_url":"http://web.archive.org/web/20260826131607/https://blockonomi.com/mantra-chain-restores-operations-following-30-hour-cosmos-evm-vulnerability-shutdown","credibility":2,"archive_timestamp":"2026-08-26T13:16:07+00:00"},{"url":"https://blockonomi.com/cosmos-evm-vulnerability-triggers-emergency-shutdowns-across-multiple-chains","name":"Cosmos EVM Vulnerability Triggers Emergency Shutdowns Across Multiple Chains — Blockonomi","type":"news_article","archive_url":"http://web.archive.org/web/20260826131528/https://blockonomi.com/cosmos-evm-vulnerability-triggers-emergency-shutdowns-across-multiple-chains","credibility":2,"archive_timestamp":"2026-08-26T13:15:28+00:00"},{"url":"https://www.cryptotimes.io/2026/08/21/mantra-chain-halts-network-unidentified-incident/","name":"MANTRA Chain Halts Network After Unidentified Incident — The Crypto Times","type":"news_article","archive_url":"https://web.archive.org/web/20260827222139/https://www.cryptotimes.io/2026/08/21/mantra-chain-halts-network-unidentified-incident/","credibility":2,"archive_timestamp":"2026-08-27T22:21:39+00:00"},{"url":"https://www.cryptotimes.io/2026/08/25/cosmos-labs-urges-evm-chains-to-halt-amid-security-incident/","name":"Cosmos Labs Urges Cosmos EVM Chains to Halt Validators, Three Now Offline — The Crypto Times","type":"news_article","archive_url":"http://web.archive.org/web/20260826133120/https://www.cryptotimes.io/2026/08/25/cosmos-labs-urges-evm-chains-to-halt-amid-security-incident/","credibility":2,"archive_timestamp":"2026-08-26T13:31:20+00:00"},{"url":"https://mpost.io/mantra-chain-halts-network-operations-after-detecting-upstream-vulnerability-freezing-all-transactions-and-withdrawals/","name":"MANTRA Chain Halts Network Operations After Detecting Upstream Vulnerability — Metaverse Post","type":"news_article","archive_url":"http://web.archive.org/web/20260826132558/https://mpost.io/mantra-chain-halts-network-operations-after-detecting-upstream-vulnerability-freezing-all-transactions-and-withdrawals/","credibility":2,"archive_timestamp":"2026-08-26T13:25:58+00:00"},{"url":"https://www.techtimes.com/articles/325233/20260821/mantra-chain-hacked-via-cosmos-evm-bug-that-already-cost-saga-7m-january.htm","name":"MANTRA Chain Hacked Via Cosmos EVM Bug That Already Cost Saga $7M in January — TechTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260822170754/https://www.techtimes.com/articles/325233/20260821/mantra-chain-hacked-via-cosmos-evm-bug-that-already-cost-saga-7m-january.htm","credibility":2,"archive_timestamp":"2026-08-22T17:07:54+00:00"},{"url":"https://www.kucoin.com/news/flash/cosmos-labs-warns-of-security-incident-affecting-cosmos-evm-module-users","name":"Cosmos Labs Warns of Security Incident Affecting Cosmos EVM Module Users — KuCoin","type":"news_article","archive_url":"https://web.archive.org/web/20260828024857/https://www.kucoin.com/news/flash/cosmos-labs-warns-of-security-incident-affecting-cosmos-evm-module-users","credibility":2,"archive_timestamp":"2026-08-28T02:48:57+00:00"},{"url":"https://cryptorank.io/news/feed/64dce-mantra-price-crashes-18-as-exploit-forces-full-blockchain-halt","name":"MANTRA Price Crashes 18% as Exploit Forces Full Blockchain Halt — CryptoRank","type":"news_article","archive_url":"http://web.archive.org/web/20260821171014/https://cryptorank.io/news/feed/64dce-mantra-price-crashes-18-as-exploit-forces-full-blockchain-halt","credibility":2,"archive_timestamp":"2026-08-21T17:10:14+00:00"},{"url":"https://dailycoin.com/mantra-chain-halts-network-after-exploit-as-token-hits-record-low","name":"MANTRA Chain Halts Network After Exploit as Token Hits Record Low — DailyCoin","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://moneycheck.com/mantra-chain-restores-operations-following-extended-network-downtime-due-to-evm-security-flaw/","name":"MANTRA Chain Restores Operations Following Extended Network Downtime — MoneyCheck","type":"news_article","archive_url":"https://web.archive.org/web/20261002082650/https://moneycheck.com/ai-agents-emerge-as-cryptos-next-major-users-powered-by-stablecoins/","credibility":2,"archive_timestamp":"2026-10-02T08:26:50+00:00"},{"url":"https://www.crowdfundinsider.com/2025/04/238682-mantras-om-crypto-token-crash-liquidity-issues-market-manipulation-allegations-recovery-plans/","name":"Mantra OM Token Crash: Liquidity Issues, Market Manipulation Allegations, Recovery Plans — Crowdfund Insider","type":"news_article","archive_url":"http://web.archive.org/web/20250906050727/https://www.crowdfundinsider.com/2025/04/238682-mantras-om-crypto-token-crash-liquidity-issues-market-manipulation-allegations-recovery-plans/","credibility":2,"archive_timestamp":"2025-09-06T05:07:27+00:00"},{"url":"https://cointelegraph.com/news/mantra-om-token-collapsed-24-hours","name":"How Mantra's OM token collapsed in 24 hours of chaos — CoinTelegraph","type":"news_article","archive_url":"https://web.archive.org/web/20261002152742/https://cointelegraph.com/magazine/mantra-om-token-collapsed-24-hours","credibility":2,"archive_timestamp":"2026-10-02T15:27:42+00:00"},{"url":"https://mantrachain.io/resources/announcements/statement-of-events-13-april-2025","name":"Statement of Events: 13th April 2025 — MANTRA Official","type":"official","archive_url":"http://web.archive.org/web/20260609001323/https://mantrachain.io/resources/announcements/statement-of-events-13-april-2025","credibility":2,"archive_timestamp":"2026-06-09T00:13:23+00:00"},{"url":"https://www.endorlabs.com/vulnerability/ghsa-54gx-3cgr-7mfm","name":"GHSA-54gx-3cgr-7mfm: Cosmos EVM incorrect state handling during nested EVM execution — Endor Labs","type":"research","archive_url":"http://web.archive.org/web/20260410145055/https://www.endorlabs.com/vulnerability/ghsa-54gx-3cgr-7mfm","credibility":2,"archive_timestamp":"2026-04-10T14:50:55+00:00"},{"url":"https://dailycve.com/cosmos-evm-state-handling-vulnerability-cve-2026-asa002-critical/","name":"Cosmos EVM State Handling Vulnerability CVE-2026-ASA002 — DailyCVE","type":"research","archive_url":"https://web.archive.org/web/20260827221922/https://dailycve.com/cosmos-evm-state-handling-vulnerability-cve-2026-asa002-critical/","credibility":2,"archive_timestamp":"2026-08-27T22:19:22+00:00"},{"url":"https://news.bitcoin.com/inveniam-capital-partners-pushes-mantra-acquisition-after-20m-bet-cementing-rwa-ai-stack/","name":"Inveniam Capital Partners Pushes Mantra Acquisition After $20M Bet — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260619032513/https://news.bitcoin.com/inveniam-capital-partners-pushes-mantra-acquisition-after-20m-bet-cementing-rwa-ai-stack/","credibility":2,"archive_timestamp":"2026-06-19T03:25:13+00:00"},{"url":"https://cryip.co/mantra-chain-halt-attacker-exploit-vulnerability/","name":"MANTRA Chain Halts Network After Confirming Attacker Exploited Upstream Vulnerability — cryip.co","type":"news_article","archive_url":"http://web.archive.org/web/20260822002034/https://cryip.co/mantra-chain-halt-attacker-exploit-vulnerability/","credibility":2,"archive_timestamp":"2026-08-22T00:20:34+00:00"},{"url":"https://coinpaprika.com/news/mantra-freezes-chain-falls-record-low-exploit/","name":"MANTRA Freezes Its Chain and Falls to a Record Low After Exploit — CoinPaprika","type":"news_article","archive_url":"https://web.archive.org/web/20260912203111/https://coinpaprika.com/news/mantra-freezes-chain-falls-record-low-exploit/","credibility":2,"archive_timestamp":"2026-09-12T20:31:11+00:00"},{"url":"https://etherworld.co/august-2026-among-worst-months-for-defi-hacks/","name":"August 2026 Among Worst Months for DeFi Hacks — EtherWorld","type":"news_article","archive_url":"https://web.archive.org/web/20260912203706/https://etherworld.co/august-2026-among-worst-months-for-defi-hacks/","credibility":2,"archive_timestamp":"2026-09-12T20:37:06+00:00"},{"url":"https://ground.news/article/cosmos-had-known-the-bug-since-april-a-valuation-error-leads-to-a-57-million-out-of-six-blockchain-exploit","name":"Cosmos EVM Vulnerability Drains MANTRA, TAC and KiiChain — Ground News / crypto.news aggregate","type":"news_article","archive_url":"https://web.archive.org/web/20260912211022/https://ground.news/article/cosmos-had-known-the-bug-since-april-a-valuation-error-leads-to-a-57-million-out-of-six-blockchain-exploit","credibility":2,"archive_timestamp":"2026-09-12T21:10:22+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-08-27T17:08:08.475085+00:00","updated_at":"2026-10-02T17:49:03.269296+00:00"},"source_quality":{"total":33,"tier1":0,"tier2":4,"tier3":0,"unrated":29},"follower_count":null,"content_updated_at":"2026-10-02T05:29:35.430Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}