FORENSIAWeb3 forensicsOpen workspace
Case file 08

MANTRA: Cosmos EVM Balance Exploit

Two wallets lost roughly 720.9 million MANTRA through shared Cosmos EVM balance accounting. The film follows the preparation, repeated transfers and chain halt, then separates funds contained from funds recovered.

Date
August 20, 2026
Network
MANTRA Chain
Reported amount
720.9M MANTRAreported extracted from two MANTRA-managed wallets
What happened
Vesting-account underflow and victim-balance overflow
Status
No recovery reported as of August 28, 2026; later status not established here
This file rests on
0 recorded and 10 reported statementsacross 2 linked identifiers
10 chapters · choose one to jump the film to it
The investigation, step by step

Replay it yourself.

These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.

  1. Two wallets, one accounting failure

    A burn address is normally treated as a destination funds cannot leave. Here, the reported exploit changed balances without the victim signing a transfer.

    Reported by others
    • About 720.9M MANTRA was extracted from two MANTRA-managed accounts.MANTRA postmortem as cited by Rekt; supplied case film

  2. Prepare the vesting account

    Vesting locks tokens for later use. The film follows a newly created vesting account before the first drain.

    Reported by others
    • The first account-creation message is reported at 19:04:50 UTC, block 17,444,907.MANTRA postmortem as cited by Rekt; supplied case film

  3. Underflow, then overflow

    Subtracting more than the EVM-tracked spendable balance wrapped an unsigned number to an enormous value. A second arithmetic failure let the contract empty a victim balance within the same transaction.

    Reported by others
    • Cosmos Labs describes two chained balance-accounting defects, not a stolen signing key.Cosmos Labs technical postmortem; supplied case film

  4. Follow the outgoing transfers

    The reconstruction groups repeated payments by destination. A deposit to an exchange address is a visible movement; an internal exchange trade is a separate claim.

    Reported by others
    • The reported exchange-bound total is 682,966,951.64 MANTRA across 15 transfers.MANTRA postmortem as cited by Rekt; supplied case film

  5. A second target

    A later sequence targeted a genesis-era multisig. Repeating the accounting path did not require the multisig owners to approve the drain.

    Reported by others
    • The second reported drain took 120,923,932.44 MANTRA at approximately 22:59 UTC.MANTRA postmortem as cited by Rekt; supplied case film

  6. The halt arrives

    Stopping block production prevents further on-chain execution. It does not undo transactions already recorded.

    Reported by others
    • MANTRA reported halting at approximately 23:13 UTC, fourteen minutes after the second drain.MANTRA postmortem as cited by Rekt; supplied case film

  7. Containment is not recovery

    About 94.7% had reached the reported exchange deposit address. The remaining balance and returned funds must be counted separately.

    Reported by others
    • About 37.96M MANTRA remained; the August 28 postmortem reported no recovered funds.MANTRA postmortem as cited by Rekt; supplied case film

  8. Follow the patch timeline

    The film compares code changes, release availability and chain response. A published fix and an installed fix are different milestones.

    Reported by others
    • The public patch history and response timeline are documented in the Cosmos Labs postmortem.Cosmos Labs technical postmortem; supplied case film

  9. Where Forensia can help

    The film moves to BNB Chain context for the related KiiChain incident. Open that case below to investigate its supported BNB receiving address. This is not a MANTRA bridge exit.

    Reported by others
    • MANTRA native execution is outside current Forensia coverage. The related KiiChain lookup does not establish a common operator.MANTRA postmortem as cited by Rekt; supplied case film

  10. What the evidence establishes

    Keep the reported token amount, exchange deposits, frozen balance and recovered assets separate. The pre-incident dollar valuation is not proof of realized proceeds.

    Reported by others
    • No attacker identity or independently retained native MANTRA capture is established by this case page.MANTRA postmortem as cited by Rekt; supplied case film
The number and the record

What the headline said. What a closer reading shows.

The headline said≈$3.6M

pre-incident spot valuation of the extracted tokens, not demonstrated sale proceeds

MANTRA postmortem as cited by Rekt; supplied case film
On a closer reading94.7%

reportedly reached an exchange deposit address before the halt

MANTRA postmortem as cited by Rekt; supplied case film
The incident on one map

Who called what, and where it went.

Recorded in the workspaceReported by others

Reported first drainReported second drain15 reported transfersRestricted after haltBurn addressAbout 600M MANTRAGenesis multisigAbout 120.9M MANTRAReceiving walletmantra13n9…d0hwvaExchange depositAbout 682.97M MANTRARemaining balanceAbout 37.96M MANTRA

An authored diagram of reported movements on MANTRA Chain, not a live Forensia graph. See the external source records below.

    Timeline

    In the order it happened.

    1. First vesting-account preparation, reported at block 17,444,907.Reported by others

    2. The first drain removes approximately 600M MANTRA from the burn address.Reported by others

    3. A second drain removes about 120.9M MANTRA from the genesis-era multisig.Reported by others

    4. The network halts after most of the extracted tokens reach a reported exchange deposit address.Reported by others

    5. The patched chain restarts. Public accounts give different restart times; this page does not resolve them.Reported by others

    6. The postmortem reports no recovered funds at publication. This is not a claim about recovery today.Reported by others

    The cast

    Every address and transaction in this case.

    Grouped by their place in the records. A group says what an address did here, not who controls it. Native MANTRA records open in the external chain explorer. They are not supported workspace lookups.

    Explore the related KiiChain case

    External source records

    MANTRA Chain is outside current workspace coverage.

    • Reported receiving walletMANTRA Chain · external explorer

      MANTRA Chain address named in the incident reconstruction. Its role is reported; the operator’s identity is not established.

      View source record ↗
    • First vesting-account preparationMANTRA Chain · external explorer

      Source-linked account-creation transaction, reported at block 17,444,907. This is preparation, not the drain transaction.

      View source record ↗
    Recorded and reported

    Two kinds of statement, kept apart.

    This page summarizes the supplied film, the incident account provided by its author and linked public reports. All incident claims are labelled reported. Film labels such as observed refer to the film author’s reconstruction; no independent native-chain capture is attached to this page. Forensia does not currently read native MANTRA Chain transactions. External explorer links are source reading, not workspace captures. The related KiiChain BNB lookup is a separate incident, not a bridge trail from MANTRA.

    What the chain records0

    No independently retained chain capture is attached to this case. Linked records and source reports are available above; workspace coverage is stated for this case.

      What others have reported10

      • Step 1

        About 720.9M MANTRA was extracted from two MANTRA-managed accounts.MANTRA postmortem as cited by Rekt; supplied case film

      • Step 2

        The first account-creation message is reported at 19:04:50 UTC, block 17,444,907.MANTRA postmortem as cited by Rekt; supplied case film

      • Step 3

        Cosmos Labs describes two chained balance-accounting defects, not a stolen signing key.Cosmos Labs technical postmortem; supplied case film

      • Step 4

        The reported exchange-bound total is 682,966,951.64 MANTRA across 15 transfers.MANTRA postmortem as cited by Rekt; supplied case film

      • Step 5

        The second reported drain took 120,923,932.44 MANTRA at approximately 22:59 UTC.MANTRA postmortem as cited by Rekt; supplied case film

      • Step 6

        MANTRA reported halting at approximately 23:13 UTC, fourteen minutes after the second drain.MANTRA postmortem as cited by Rekt; supplied case film

      • Step 7

        About 37.96M MANTRA remained; the August 28 postmortem reported no recovered funds.MANTRA postmortem as cited by Rekt; supplied case film

      • Step 8

        The public patch history and response timeline are documented in the Cosmos Labs postmortem.Cosmos Labs technical postmortem; supplied case film

      • Step 9

        MANTRA native execution is outside current Forensia coverage. The related KiiChain lookup does not establish a common operator.MANTRA postmortem as cited by Rekt; supplied case film

      • Step 10

        No attacker identity or independently retained native MANTRA capture is established by this case page.MANTRA postmortem as cited by Rekt; supplied case film

      Keep going

      The ideas behind this case, and what to read next.

      Docs · 5 minHow to read a transaction

      What each field means, which ones matter first, and the order to read them in.

      Docs · 4 minWhat on-chain data cannot tell you

      The limits that hold no matter how good the tooling is.

      Case · KiiChain / BNB Chain · Balance accountingKiiChain: Cosmos EVM Balance Exploit

      148.3M KII, reported drained across 18 targets.

      Case · Ethereum · SigningBybit: Multisig Wallet Takeover

      $1.5B, from one Bybit wallet.

      Source reading

      Reports behind this case.

      Share and cite

      Take the case with you.

      The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.

      FORENSIA

      Web3 forensics that shows its sources. Read-only, public evidence, and a clear line where the proof ends.

      Contact us

      Leave your name and email and the Forensia team will write back.

      How we handle your emailOr email us directly

      By selecting Contact me you agree that Forensia may email you at this address about your enquiry. You can withdraw anytime. Name, email and consent are kept for up to 90 days, separately from investigations. No searched address is included in this submission.