MANTRA Chain resumes as undisclosed code changes raise developer concerns

MANTRA Chain restored mainnet block production on v8.4.0 after a security incident forced a chainwide halt. The official timeline placed the restart at approximately 05:30 UTC on Aug. 22. The chain said no rollback or state change occurred between the halt and restart. The chain said user balances were not altered. The chain said token holders did not need to take action. The team marked the incident resolved on Aug. 24. The team again said a postmortem would arrive in the coming days. The status page and official announcement channel contained no link to the report when checked on Aug. 27. MANTRA said its analysis found that two MANTRA-managed wallets were affected. MANTRA said no user, exchange, or partner funds were affected. MANTRA has not publicly identified the wallet addresses. MANTRA has not publicly provided transaction hashes, amounts, or technical exploit steps. The missing postmortem leaves the exploitation of an upstream dependency unexplained. The missing postmortem also leaves the attacker's method unexplained. The public code record points node operators to full commit 5c08d7bd9e2619952707dae1258d2a30bf024721 for the current v8.4.0 build. MANTRA said the tag was re-pushed during recovery and told operators to re-pull it. The release changelog lists an intermediate MANTRA EVM fork change from v0.6.0-v8-mantra-3 to v0.6.0-v8-mantra-4. The final tagged release replaces that dependency with the chain's v0.6.2-v8-mantra-1 fork. The final upgrade handler blocklists one address. The handler also disables three Cosmos vesting-account creation messages through the circuit breaker. These code changes have raised developer concerns. A March Cosmos Labs advisory described a critical ICS20 precompile flaw. The advisory said known affected chains had mitigated or upgraded. The advisory named Mantra among remediation collaborators. The advisory timeline ended with the March disclosure, so it did not document the August incident. The public record confirms the restart, the final code, and MANTRA's stated impact. Wallet addresses, transaction hashes, amounts, and a technical explanation remain unavailable for tracing the wallet impact or determining whether the incident repeated the earlier ICS20 flaw.