Two Chains Hit the Kill Switch in One Day

Two networks hit the kill switch within the same 24 hours, for very different reasons. MANTRA Chain halted on Friday after an incident its team traced to the chain's Cosmos EVM module, the component that lets a Cosmos-built chain run Ethereum-style contracts. BounceBit went further: The Block reported the same day that the bitcoin-restaking project will permanently sunset its Layer 1 and migrate to BNB Chain, after an authorization flaw let an attacker move roughly 286.5 million BB tokens out of nine accounts. One stoppage is meant to end with a restart. The other is final.

The halt came first, then the diagnosis

OM took the damage immediately. The token fell 18.5% on Friday to an all-time low of $0.004126, from $0.005060, while 24-hour volume jumped roughly 600% to $24 million, per Cointelegraph. MANTRA suspended all endpoints, transactions, transfers and staking while it worked. The team's statement, carried by Crypto Economy, was unusually specific about scope.

"The incident was isolated to the Cosmos EVM module of MANTRA Chain and affected two wallet addresses before we achieved containment," the statement said. It added that no user funds were exploited.

A patched build, v8.4.0, was tested on the DuKong testnet, and validators were told to stay offline until a coordinated restart the team aimed to complete within a day. CryptoSlate reported that a full network snapshot was captured first, and that the asset impact of the attacker's activity remained unconfirmed at its press time. Those two accounts sit uneasily together; only the promised post-mortem can square them. As of Saturday evening, none of the coverage we surveyed confirmed that the restart had been completed. The chain was halted, not dead. OM itself bounced 15.24% off the low, to around $0.0046 per Crypto Economy.

A bug class with a prior record

TechTimes tied the flaw to the same Cosmos EVM bug class that cost Saga $7 million in January, turning a one-chain incident into a pattern question for every network running the module. Harmony, for comparison, answered a forged mint this month with an emergency patch and a planned rollback. MANTRA reached for the halt. BounceBit took the exit.

BounceBit picked the permanent option

The BounceBit numbers need care. The Block valued the stolen tokens at around $3 million, and both figures describe one event; the dollar amount is small because BB's price was already depressed, so the token count is the better measure of scale. Rather than patch and relaunch, the project decided the chain itself was not worth saving. Its migration target, BNB Chain, is the same network the exploited tokens were moved to.

The attack surface moved upstream

Neither incident arrived alone. On Thursday the official Rust blog disclosed a coordinated poisoning of three code libraries, delivered through a typosquatted proc-macro1 dependency that executed a remote payload at build time. The largest, arrayref v0.3.10, has roughly 245 million cumulative downloads per the disclosure and sits in Solana-related dependency trees, so crypto coverage centered on Solana-adjacent build pipelines; BleepingComputer described the payload as an infostealer. The route resembles the backdoored Injective SDK on npm: compromise the tooling, and every project that builds with it inherits the hole. Coldcard's follow-up ran in the same current — Coinkite shipped firmware 5.6.1 on Thursday, and users with seeds generated on vulnerable firmware still have to move their bitcoin.

The restart is the next test

MANTRA's team promised a full post-mortem, and confirmation that the coordinated restart worked is the first thing to check against it. BounceBit still owes holders the mechanics of the BNB Chain migration. The week's larger lesson lands on maintainers: two of its worst incidents began in shared infrastructure, a chain module and a package registry, before any attacker touched a wallet. Proportion matters here. A halted chain can come back within a day. A poisoned dependency with 245 million downloads takes longer to trust again.