MANTRA has found a way to take back some of the tokens stolen from its blockchain in August.
There’s just one problem.
Nearly 95% of the stolen tokens had already left the attacker’s wallet.
Now, the project wants its community to approve a software upgrade that would forcibly retrieve the remaining 37.96 million MANTRA. Recovering the rest is a considerably more complicated matter, involving a centralized exchange and Hong Kong law enforcement.
And even if the proposal succeeds, the recovered tokens won’t simply return to their original addresses.
The 683 Million Tokens That Got Away
The story began on August 20, when an attacker exploited an unsigned-integer underflow vulnerability in an upstream Cosmos EVM component.
According to MANTRA’s official incident post-mortem, the attacker withdrew 720,923,967.99 MANTRA without authorization.
Roughly 600 million came from a burn address, while another 120.92 million came from a legacy multisignature wallet associated with an incentive program.
The attacker then executed 15 outbound transfers totaling 682,966,951.64 MANTRA, primarily to an exchange deposit address.
Ravel calculates that those transfers represented 94.74% of the entire exploit.
Only a small fraction remained when MANTRA halted the network and subsequently restricted the attacker’s address through its v8.4.0 upgrade.
That distinction matters.
As Ravel previously examined in the Binance stolen-crypto recovery case, freezing assets doesn’t automatically mean recovering them.
MANTRA could immobilize the remaining tokens at the protocol level. But the funds already deposited at an exchange require cooperation beyond the blockchain itself.
The Recovery Has Another Catch
On November 6, MANTRA opened voting on Governance Proposal #40, seeking approval to retrieve exactly 37,957,488.23 MANTRA from the sanctioned wallet.
The proposed upgrade would transfer those tokens into the OM Upgrade incentives allocation.
That destination is important.
The original exploit removed 120,923,932.44 MANTRA from the legacy incentive allocation. Recovering the frozen balance would restore just 31.39% of that shortfall, according to Ravel’s calculation.
Another 82,966,444.21 MANTRA would still be required.
Any additional recovered tokens would first replenish that allocation. Amounts exceeding the shortfall would be permanently burned.
The proposed intervention also raises a familiar question about blockchain ownership.
Ravel recently documented how Arbitrum moved roughly $30 million in stolen assets without the hacker’s private key.
MANTRA is proposing a different technical approach, using an authorized software upgrade to transfer assets from a restricted address.
In both cases, the network’s governance mechanisms can ultimately determine whether someone holding a wallet’s private key can keep control of its assets.
The proposal remains subject to community approval, with voting scheduled to conclude on November 13.
Meanwhile, MANTRA says it continues working with Hong Kong law enforcement and the receiving exchange. How much of the remaining funds can actually be recovered is still unknown.
The published figures establish the scale of the withdrawals and the proposed recovery, although Ravel has not independently reconstructed every transaction through an archival node.
For now, MANTRA has a plan for the tokens it can control.
The other 683 million are a reminder that knowing where stolen crypto went and having the power to retrieve it are two very different things.
