MANTRA Web3Auth Key Compromise

On November 13, 2026, MANTRA — the real-world-asset layer-1 behind the OM token — disclosed a security breach in which attackers drained liquid balances and force-unbonded users' staked tokens after a vulnerability in wallet-infrastructure providers Web3Auth and Keplr exposed the private keys of accounts created through Google and Apple social logins. The total amount stolen was not disclosed.

What happened

MANTRA Chain lets users onboard with a familiar social login — signing in with a Google or Apple account rather than recording a seed phrase. Behind that convenience sits Web3Auth, an embedded key-management service that derives and custodies the wallet's signing key on the user's behalf, wired into the Keplr wallet used across the Cosmos ecosystem.

The reported root cause was an infrastructure vulnerability in Web3Auth that exposed the private keys for a portion of these social-login wallets — by one account roughly 20% of affected accounts. Wallets secured by a 12- or 24-word seed phrase or a hardware device were not affected, because their keys never pass through the provider.

With working signing keys in hand, the attackers:

1. Swept liquid balances out of compromised addresses.
2. Initiated proof-of-stake unbonding on victims' staked OM, aiming to convert locked delegations into transferable tokens they could steal once the unbonding period elapsed — "unbonding their staked MANTRA tokens without their consent," as the team put it.

Aftermath

• MANTRA imposed a seven-day emergency suspension on all new unbonding transactions to buy time, while warning that requests already inside the standard eight-day unbonding queue would continue to mature and should be re-delegated immediately.
• The team froze multiple attacker-associated addresses on-chain through Governance Proposal 41.
• Web3Auth and Keplr suspended Google and Apple OAuth sign-ins and moved roughly $5.6 million of still-at-risk assets into provider-controlled recovery wallets across Cosmos and EVM networks before attackers could reach them.
• The OM token fell about 7.3% in the hours after disclosure. MANTRA said it was coordinating recovery with both providers; the final drained total remained undisclosed.

Why it matters

MANTRA's breach is a custodial-key failure one layer removed from the user: nobody lost a seed phrase, yet many wallets were exposed because the key material lived inside a shared third-party service. It belongs to the same 2026 pattern — operational and key-management compromise, not smart-contract bugs, driving the largest losses — that produced the Binance hot-wallet theft, the Bitget breach and the Duelbits wallet drains.

Two lessons stand out. First, social-login wallets concentrate risk: the feature that removes the seed phrase also removes the user's sole control of the key, so a single provider bug becomes a fleet-wide compromise. Second, staking amplifies the blast radius — attackers could not instantly move locked OM, but by force-unbonding it they turned a liquidity theft into a slow-motion drain, which is exactly why MANTRA's defensive move was to freeze the unbonding pipeline itself.