- Published on
Maya Protocol exploit drains bitcoin and other assets as pool value drops $11 million
- Authors
- Name
- DeepHorus
Maya Protocol halted its MAYAChain network after an attacker exploited a chain of six software bugs to drain approximately $1.7 million in bitcoin and other assets. The cross-chain liquidity protocol suspended all trading on August 18, 2026, according to founder AaluxxMyth. The attack exploited false balances in a liquidity pool, causing widespread damage beyond the stolen funds.
MAYAChain is a smaller cross-chain trading network that allows users to swap assets like bitcoin and ether without routing through a centralized exchange. Traders interact with pools of crypto deposited into the network, with the CACAO token acting as the common asset connecting those markets. The protocol is part of the broader Maya ecosystem.
A technical reconstruction revealed that the attack depended on six bugs working in sequence. The chain began when MAYAChain mistakenly flagged an outgoing transaction as missing and triggered code meant to compensate a liquidity pool after a theft. That safety mechanism miscalculated the compensation, adding roughly 49 million CACAO to a small pool even though the reserve held only about 168,000 CACAO.
The transfer failed, but another bug saved the new balance in the network's records. Instead of reversing the change, MAYAChain continued operating as though the pool contained the extra tokens. The attacker then deposited a tiny amount into the distorted pool, gaining ownership of more than 99% of it, and immediately withdrew 48.87 million CACAO.
The attacker swapped those tokens for bitcoin, ether and other assets. Onchain records show 20.83 BTC, worth about $1.34 million, was sent to the attacker's bitcoin address, while assets moved to external blockchains at roughly $1.36 million. Another 8.87 million CACAO remained in the attacker's MAYAChain wallet.
The exploit triggered a collapse in CACAO's price. The token traded around $0.115 before the attack and fell as low as $0.013, a drop of nearly 89%, before recovering to around $0.03. Arbitrage traders bought the suddenly cheap token and exchanged it for assets in MAYAChain's pools, amplifying the damage.
The technical analysis estimated the attacker personally extracted about $1.65 million, while the total pool value fell by approximately $10.9 million. Only a portion of that represents direct theft; the rest came from arbitrage and the CACAO crash. This distinction matters for assessing the protocol's losses.
Founder AaluxxMyth said on X: "Sad news. Will work to fix and recover in full. We carry on." The protocol halted all trading to contain damage and is working on a fix before swaps resume. The incident highlights how multiple narrow bugs can combine into a much larger failure.
