MANTRA Token Plunges 18% to Record Low as Blockchain Halts After Tokenfactory Exploit

CoinGecko data shows the trader who bought MANTRA at $0.0050 on Wednesday evening watched the position shed 18% in under an hour Thursday night as the chain froze. MANTRA's native token touched $0.004126 at 11:00 pm UTC Thursday, an 18.5% plunge from the 24-hour high of $0.005060, per CoinGecko. Three minutes later the network produced its final block, 17,449,398, and went silent. At 11:44 pm the team posted on X that it had halted MANTRA Chain as a precaution while investigating an "incident," adding it had no root cause or timeline to share.

The vulnerability class and how it was exploited

The attack vector matches CVE-2025-61595, a high-severity flaw (CVSS 8.8) disclosed September 30, 2025, in the tokenfactory module's send hooks. The bug allows send hooks to spend more gas than remains in the transaction; combined with recursive calls in a WASM contract, gas consumption amplifies exponentially. GitHub advisories show the vulnerability affects mantrachain versions prior to 4.0.2 and 5.0.0-rc8. The project said Friday an attacker exploited "a vulnerability in software used by the chain", language consistent with the tokenfactory gas DoS.

Response — pauses, patches, negotiations

MANTRA's status page classified the event as a full outage affecting public endpoints, validators, bridge migration operations, and MANTRA-managed IBC relays. The team said it would not restart until confident the network is safe. Exchanges paused deposits and withdrawals with no resumption timeline. No patch deployment has been announced; the fixed versions (v4.0.2, v5.0.0) have been available since October 2025.

User impact and exposure

Holders cannot move assets on MANTRA Chain. Bridged assets and IBC relays are frozen. The project has not confirmed whether any funds were drained or placed at risk beyond the price impact. per CoinGecko, trading continues on centralized venues, volume spiked nearly 600% to $24 million, but on-chain withdrawal is impossible until the network restarts.

Sector implication — who else runs this code

MANTRA Chain is built on the Cosmos SDK. The tokenfactory module is a shared component used by multiple Cosmos-based chains for native asset issuance. Any chain running an unpatched mantrachain fork (pre-4.0.2) inherits the same send-hook gas DoS surface. The vulnerability was patched upstream in October 2025; operators who have not upgraded remain exposed.

The April 2025 precedent

This is the project's second catastrophic price event. Figures from the desk show in April 2025 the former OM token collapsed more than 90% from roughly $6.30 to below $0.50, erasing over $5 billion in market cap. At the time the team blamed centralized exchange liquidations; on-chain investigators flagged large pre-crash transfers to OKX. A one-for-four denomination and rebrand followed in March 2026, replacing the OM ticker with the current MANTRA token.

The open question

Whether the chain restarts on a patched binary, and whether the exploit extracted value beyond the market disruption, will determine if this is a temporary halt or a repeat of the 2025 confidence break. The team's next update, the validator set's upgrade coordination, and any on-chain forensic evidence of fund movement are the watchpoints.