Skip to main content
AVOID.NET

MANTRA Chain (August 2026 Exploit)

avoid.net/mantra-chain-august-2026-exploit38/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2uomzC…5YgC

Summary

On August 20, 2026, MANTRA Chain — an RWA-focused Cosmos-based Layer 1 — suffered an exploit of a critical vulnerability in its upstream Cosmos EVM module, forcing a full network halt of approximately 30 hours and causing its OM token to drop 18% to a record low of $0.004126. Approximately 720.9 million OM tokens worth roughly $3.6 million were drained across the incident, part of a coordinated attack pattern that ultimately affected six Cosmos EVM chains and converted approximately $5.72 million in stolen assets across the ecosystem. This page covers the August 2026 security incident; the April 2025 token price collapse is documented separately under the 'mantra-chain' entry.

Have evidence about MANTRA Chain (August 2026 Exploit)?

Timeline(11 events)

25 April 2026

Cosmos EVM vulnerability (GHSA-7g4w-cg88-2cq2) first reported through the Cosmos Bug Bounty Program on HackerOne. Initial Cosmos Labs assessment incorrectly concluded no production chain was at risk.

Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub

15 May 2026

Silent fix for the Cosmos EVM vulnerability merged to the main branch without public disclosure identifying the vulnerability addressed.

Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub

19 August 2026

Patched Cosmos EVM releases (v0.6.2 and v0.7.2) made available with vague security notes, approximately 20 hours before the first known attack.

Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain — crypto.news

20 August 2026

At 07:16 UTC, Push Chain publicly posted detailed exploit methodology and vulnerable release tags on GitHub (pushchain/push-chain-evm#40), hours before the first attack.

Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub

20 August 2026

First known attack on MANTRA Chain began at approximately 19:06 UTC (3:06 PM ET).

Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub

20 August 2026

MANTRA Chain halted block production at block 17,449,398 at approximately 23:13 UTC. All transactions, deposits, and withdrawals frozen. OM token fell 18% to a record low of $0.004126.

MANTRA token plunges 18% to record low as blockchain halts after exploit — CoinDesk

22 August 2026

MANTRA Chain resumed block production at approximately 05:30 UTC on patched software version 8.4.0 after approximately 30 hours offline. No rollback; user balances confirmed unaltered.

MANTRA Freezes Its Chain and Falls to a Record Low After Exploit — CoinPaprika

22 August 2026

TAC exploited at approximately 19:46 UTC at block 24,671,475 using the same Cosmos EVM vulnerability. KiiChain subsequently attacked beginning around 21:00 UTC, with 148.3 million KII tokens drained across 18 repeated attacks.

Cosmos Labs urges Cosmos EVM chains to halt amid security incident — CryptoTimes

24 August 2026

Cosmos Labs issued a public advisory urging all Cosmos EVM chains to request that validators halt their chains, confirming an ongoing security incident. Cosmos Labs coordinated with approximately 40 chains.

Cosmos Labs urges Cosmos EVM chains to halt amid security incident — CryptoTimes

25 August 2026

Cosmos Labs closed the active exploit response window at 15:20 UTC. Total cross-chain losses across six networks tracked at approximately $5.72 million converted through decentralized and centralized exchanges.

Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub

28 August 2026

Cosmos Labs published full post-mortem for GHSA-7g4w-cg88-2cq2, detailing the underflow/overflow exploit chain, the April 2026 disclosure failure, and the Push Chain public posting as a contributing factor.

Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem — cosmos/security GitHub
Provenance & Audit Trail

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 9 of 10 cited source URLs have an Internet Archive snapshot.

model: claude-sonnet-4-6

generated: 9/12/2026, 5:16:10 PM

last updated: 9/12/2026, 9:17:00 PM

avoid.net — verified advice for a post-truth world