MANTRA Web3Auth Key Compromise
A Web3Auth vulnerability exposed private keys for Keplr social-login wallets, letting attackers drain liquid balances and force-unbond staked OM on MANTRA Chain.
Vuln-watch · relayed from a public source; see Source & attribution below
Summary
A Web3Auth vulnerability exposed private keys for Keplr social-login wallets, letting attackers drain liquid balances and force-unbond staked OM on MANTRA Chain.
Incident
- Victim: MANTRA
- Date (UTC): 2026-11-13
- Chain(s): MANTRA Chain
- Attack type: private key compromise
- Funds status: stolen
Recommended actions
- If you use MANTRA, move funds to a fresh wallet with a new seed phrase once the vendor confirms the root cause
- Update the wallet software only from official sources
- Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only
Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/mantra-2026. Primary sources: https://crypto-economy.com/mantra-suspends-unbonding-requests-for-7-days-following-security-breach/ ; https://www.brinztech.com/breach-alerts/brinztech-alert-mantra-chain-reports-ongoing-web3auth-and-keplr-key-exploit-driving-unauthorized-token-unbonding ; https://www.kucoin.com/news/flash/mantra-suspends-unbonding-for-7-days-due-to-keplr-private-key-vulnerability.
References
- https://www.blockchainbreaches.com/en/breaches/mantra-2026
- https://crypto-economy.com/mantra-suspends-unbonding-requests-for-7-days-following-security-breach/
- https://www.brinztech.com/breach-alerts/brinztech-alert-mantra-chain-reports-ongoing-web3auth-and-keplr-key-exploit-driving-unauthorized-token-unbonding
- https://www.kucoin.com/news/flash/mantra-suspends-unbonding-for-7-days-due-to-keplr-private-key-vulnerability
Indicators of compromise
All IOC feeds →- addressmantra18p9zvpl2qz664swphd20pg252z7r34f8t7h3d2Hacker wallet frozen by MANTRA Gov Prop 41 (Keplr/Web3Auth key exploit), per MANTRA · MANTRA
- addressmantra19tzwf85z433xx20h0xksuq66xrfp0kq8peler0Hacker wallet frozen by MANTRA Gov Prop 41 (Keplr/Web3Auth key exploit), per MANTRA · MANTRA
- addressmantra1ng0kmvd2rz7mzh9x6227n8mqc43whn58rclevgHacker wallet frozen by MANTRA Gov Prop 41 (Keplr/Web3Auth key exploit), per MANTRA · MANTRA
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-11-13 · last updated 2026-11-14
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0348/signed.txt | gpg --verify