The attacker's wallet still contained 37.96 million tokens when validators pulled the network at 23:13 UTC, fourteen minutes after the second drain [8], out of 720,923,967.99 moved in total [3], which is 5.3 percent [1] and leaves 94.7 percent, or roughly 683 million tokens, already off-chain [2]. Marked at the pre-incident five-tenths of a cent, the stranded remainder is about $189,800 [3]. Law enforcement is involved and recovery updates are pending [11], which is roughly what a project says when the arithmetic looks like that.
The mechanism is the plain kind. The affected cosmos/evm version approved subtractions from an account balance without first checking the account could cover the call, and because balances are unsigned integers, a subtraction below zero wrapped upward into an enormous number rather than failing [4]. MANTRA says no validator key or governance control was breached, and that the attacker needed no privileged access at all: a permissionlessly deployed contract and a self-funded wallet were sufficient [5][6]. That is the part that travels. The flaw lived in the shared module MANTRA uses to run Ethereum-style contracts on a Cosmos SDK chain [2], so the live question for any other operator is not whether MANTRA's engineers were sloppy but which version of that module they themselves are running, and the post-mortem, which names v8.4.0 as the patched release validators restarted on after 30 hours and 13 minutes offline [9], supplies no inventory of the other chains sitting on the affected code.
The $3.6 million is a price, and a stale one. It marks 720.9 million tokens at $0.005, where they traded before the incident [3]; during the halt the token printed a record low near $0.004126 [13], which is 17.5 percent below that mark [4], so the 18.5 percent decline CoinGecko recorded was measured against some other reference [13][4]. An attacker liquidating 682.96 million tokens, nominally $3.41 million [5], is selling into a bid the theft itself moved. MANTRA frames the event as 720.9 million economically inert tokens entering circulation, with no tokens minted and no customer balance debited [7], and the circulating supply restatement is deferred until it knows what is stuck in hacker wallets [11].
The counter-read, or rather the more interesting version of it, is that this was an accounting correction: a burn address that nobody watched around the clock [10] was not a burn address but a holding account with a good name, and the honest supply figure was always the larger one. This is probably wrong, but I think the dependency exposure matters more than the $3.6 million, because an unchecked subtraction is bounded only by whatever inert balances a chain has parked where it is not looking, and the split here was 600 million from the burn address plus 120.9 million from a dormant genesis-era multisig tied to an old incentive campaign [12]. What would falsify it: a cosmos/evm disclosure timeline showing the fix was available before August 20, which makes this a patching failure rather than a shared one. For Inveniam Capital Partners, which put $20 million in during 2025 and agreed in June to acquire the project [14], the event is 18 percent of that cheque [6], and set against an April 2025 session that took the old OM token down more than 90 percent and erased over $5 billion [15], it barely registers.
