MANTRA Suspends Unstaking for 7 Days Following Keplr Wallet Security Breach

The Layer 1 blockchain project MANTRA has announced an emergency seven-day suspension of all unstaking transactions following a critical security incident. The decision comes in response to a private key leakage vulnerability involving Web3Auth and Keplr wallets, which has allowed unauthorized actors to target pledged assets. By halting the withdrawal process, the MANTRA team aims to provide a buffer period to secure user funds and prevent further illicit transfers of the network's native tokens.

Details of the Keplr Private Key Vulnerability

The security breach originated from a private key leakage affecting users who integrated Web3Auth with Keplr wallets. According to official statements from MANTRA, attackers initially drained liquid assets from compromised accounts before initiating the unstaking process for pledged tokens without the owners' consent. This exploit posed a significant risk to the long-term security of the ecosystem's staked capital.

• The suspension will remain in effect for a minimum of 7 days.
• Unstaking transactions that were already in progress prior to the announcement will not be affected by this freeze.
• The MANTRA team will reassess the security landscape at the end of the week-long period to determine if further measures are required.

Mitigation Strategies and Governance Actions

This emergency measure follows previous efforts by the MANTRA community to neutralize the threat. Under governance proposal number 41, the network successfully froze multiple wallets associated with the hackers. However, the ongoing nature of the vulnerability necessitated a broader pause on withdrawals. Governance-led interventions are often used in the Cosmos ecosystem to protect the integrity of the chain during active exploits.

Users need to re-delegate before the 8-day unstaking period ends to prevent their assets from being claimed by hackers.

To ensure the safety of their holdings, affected users are advised to re-delegate their tokens before the standard eight-day unstaking window concludes. This action effectively cancels the pending withdrawal initiated by the attacker, keeping the assets within the staking protocol and out of reach of the compromised keys.

In conclusion, the temporary halt serves as a defensive maneuver to safeguard the MANTRA (OM) ecosystem while developers and security researchers work to resolve the underlying wallet vulnerabilities. Investors are encouraged to monitor official communication channels for updates on the resumption of services and to audit their private key security if they utilize Web3Auth or Keplr integrations.