Morning Edition · Saturday, August 22, 2026Published at 1:43 AM EDT · New York
Validators remain offline pending a patch test, while a forged cross-chain message drained a bridge router on Base and a staking protocol's mispriced reward pool drew a public proof-of-concept.

MANTRA Chain, a Cosmos-based network focused on tokenized real-world assets, remains offline after an attacker exploited a vulnerability in what the team called an upstream dependency, meaning software the chain uses but does not itself develop. CryptoSlate reports that transactions, transfers, staking and bridge operations are all unavailable and that a restart depends on validators testing a patched release. Exchange partners have suspended deposits and withdrawals for the OM token, which CoinDesk reported fell about 18% to a record low near $0.0041.
MANTRA has not disclosed the amount stolen, the specific dependency, or the final financial impact. A halt on a proof-of-stake chain is a coordination decision made by validators, and it is the clearest available evidence of how concentrated that validator set is. The incident arrives while MANTRA is subject to a pending acquisition by Inveniam Capital Partners, expected to close in the third quarter.
Two smaller incidents were documented in the same period. Security researchers at DeFiHackLabs published a proof-of-concept for a phantom deposit against Allbridge's cross-chain transfer router on Base. The router credited a forged Circle attestation message as a genuine deposit without verifying it, letting the attacker book a fictitious $1 million balance, cover the shortfall with a flash loan and remove the router's entire 191,156 USDC. The root cause was missing verification of an off-chain message the contract was designed to trust.
The same repository carries a proof-of-concept against FlashstakeV2, a protocol that pays yield upfront, where a mispriced reward pool allowed an attacker to claim an instant reward larger than the deposit justified. That is a logic and pricing defect rather than a memory or access-control bug. No loss figure has been confirmed, and neither incident has a public attribution. Rekt News has tracked this pattern throughout the year: bridges and trusted message paths account for a large share of the value lost.
Part of a tracked trend
Bridge and Mint Exploits Sustain Heavy DeFi Losses
Over 3-6 months, recurring bridge proof-validation and unauthorized-mint exploits keep monthly DeFi losses elevated, including drains of deprecated contracts.
Start a discussion in Townsquare.
More from this edition
The "upstream dependency" description moves fault to software MANTRA did not write, which protects the pending Inveniam Capital Partners acquisition and shields validators from responsibility for a halt that prevented holders from selling into a falling price.
MANTRA has not named the dependency, the stolen amount or the attacker, so the independently confirmed facts are the halt, the patched v8.4.0 release under test on the DuKong testnet and the price move, with the 18% figure drawn from CoinDesk's CoinGecko data while other outlets reported closer to 10% over 24 hours.
An open-source-intelligence read of how likely this story is true with its real nuance, not a judgment of any outlet. It assesses the claim, weighing independent and adversarial reporting. How we label confidence.
What this means
The Allbridge and MANTRA incidents both trace to components outside the contract being audited, an unverified cross-chain message in one case and third-party chain software in the other. Protocols that scope audits to their own Solidity or Rust code keep missing this surface, and users of bridges and young layer-1 networks carry the residual risk. For MANTRA specifically, a halted chain means holders cannot exit at any price, which is why the token repriced before the network came back rather than after.
What to watch
Observations to monitor, not financial advice.
Synthesized from: CryptoSlate · CoinDesk · DeFiHackLabs · DeFiHackLabs (Flashstake) · Rekt News
Comments
1Aug 23, 4:41 AM · edited
Withholding the dependency name leaves other Cosmos ecosystem chains unable to assess their own exposure until MANTRA publishes patch details.